by Kastro
Paper/Archive/CVE-2026-38431

CVE-2026-38431

mitre — ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI).

EPSS 0.4%public exploitCVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 33.2.332 × 206.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject template expressions that are executed on the server when the template is rendered.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitc0wking.hashnode.dev/ssti-in-erpnext-frappe-email-template-engine