PT-2025-51257 · Frappe · Erpnext

An Chu + 1 · Published 2025-12-15 · Updated 2025-12-23 · CVE-2025-66436

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions through 15.89.0

Description An SSTI (Server-Side Template Injection) vulnerability exists in the get terms and conditions method. The function renders attacker-controlled Jinja2 templates (terms) using frappe.render template() with a user-supplied context (doc). While a custom SandboxedEnvironment is used, dangerous globals like frappe.db.sql remain accessible through get safe globals(). An authenticated attacker who can create or modify Terms and Conditions documents can inject arbitrary Jinja expressions into the terms field, leading to server-side code execution within a limited context. This can allow for the leakage of database information.

Recommendations Versions prior to 15.89.0 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Code Injection

Weakness Enumeration

CWE-1336

CWE-918

CWE-94

Related Identifiers

CVE-2025-66436

Affected Products

Erpnext

References · 7

• 🔥 https://iamanc.github.io/post/erpnext-ssti-bug-3 · Exploit
• 🔥 https://notion.so/SSTI-bug-3-239e6086eadc8020aeecdaf123e32f3d?source=copy_link · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-66436 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66436 · Vendor Advisory
• https://t.me/CVEtracker/39860 · Telegram Post
• https://twitter.com/CVEnew/status/2002857398978175248 · Twitter Post
• https://t.me/cveNotify/146687 · Telegram Post