CVE-2026-72911 ERPNext: Possibility of server-side template injection due to missing validation

🗓️ 10 Aug 2026 21:00:46Reported by GitHub_MType

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render s...

Reporter	Title	Published	Views	Family All 5
ATTACKERKB	CVE-2026-72911	10 Aug 202621:00	–	attackerkb
Circl	CVE-2026-72911	10 Aug 202621:24	–	circl
CVE	CVE-2026-72911	10 Aug 202621:00	–	cve
EUVD	EUVD-2026-55833	10 Aug 202621:00	–	euvd
NVD	CVE-2026-72911	10 Aug 202621:17	–	nvd

[
  {
    "vendor": "frappe",
    "product": "erpnext",
    "versions": [
      {
        "version": "< 15.118.0",
        "status": "affected"
      },
      {
        "version": ">= 16.0.0, < 16.29.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/frappe/erpnext/security/advisories/GHSA-qq49-v74j-hjh7
github	www.github.com/frappe/erpnext/releases/tag/v16.29.0
github	www.github.com/frappe/erpnext/releases/tag/v15.118.0
github	www.github.com/frappe/erpnext/pull/56458
github	www.github.com/frappe/erpnext/commit/88443e4a97c6c0a40d85a9e6785577191296ee39
github	www.github.com/frappe/erpnext/commit/5f6952b15c1f6ee893770d5bc618558a6ba41a28
github	www.github.com/frappe/erpnext/commit/ecb6d48ec025e0c94abac35b2e4f7607f4c86465

10 Aug 2026 21:00Current

CVSS 3.19.9

CWE-1336