PT-2026-60210 · Frappe · Erpnext

CVE-2026-55242 · Published 2026-07-15 · Updated 2026-07-16

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ERPNext versions prior to 15.111.0 ERPNext versions prior to 16.22.0

Description An authenticated user with a standard operational role can trigger server-side template injection through a configuration field. This allows for the unauthorized disclosure of data that falls outside the user's normal permission scope. Server-side template injection occurs when an attacker injects malicious code into a template that is then executed on the server.

Recommendations Update to version 15.111.0. Update to version 16.22.0.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-1336

CWE-863

Related Identifiers

CVE-2026-55242

GHSA-PXF3-4GVC-V45J

Affected Products

Erpnext

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55242.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-55242 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-55242 · Security Note
• https://github.com/frappe/erpnext/security/advisories/GHSA-pxf3-4gvc-v45j · Note
• https://reddit.com/r/pwnhub/comments/1uxow3o/erpnext_vulnerability_allows_authenticated_users · Reddit Post