PT-2025-51252 · Frappe · Erpnext

An Chu + 1 · Published 2025-12-15 · Updated 2025-12-15 · CVE-2025-66434

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions through 15.89.0

Description A Server-Side Template Injection (SSTI) issue exists in the get dunning letter text method. The function renders Jinja2 templates ()body text) using frappe.render template() with a user-supplied context ()doc). Despite the use of a SandboxedEnvironment, dangerous globals like frappe.db.sql remain accessible through get safe globals(). An authenticated attacker who can configure Dunning Type and its child table Dunning Letter Text can inject Jinja expressions, potentially leading to server-side code execution in a limited context and information disclosure from the database.

Recommendations Versions prior to 15.89.0 should be updated.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-1336

CWE-94

Related Identifiers

CVE-2025-66434

Affected Products

Erpnext

References · 7

• 🔥 https://iamanc.github.io/post/erpnext-ssti-bug-1 · Exploit
• 🔥 https://notion.so/SSTI-bug-1-239e6086eadc8096bfcfe90551a3a483?source=copy_link · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-66434 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66434 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2000656191387574344 · Twitter Post
• https://t.me/CVEtracker/39857 · Telegram Post
• https://twitter.com/CVEnew/status/2000617524593897782 · Twitter Post