Vulnerabilities CVE-2026-55242

CVE-2026-55242

High

Open

TLP:CLEAR

ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can trigger server-side template injection through a configuration field, resulting in unauthorized disclosure of data outside the user's normal permission scope. This issue is fixed in versions 15.111.0 and 16.22.0.

Details

CVSS Score: 8.8
EPSS Score ⓘ: 0.14%

3.5th percentile
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Confidence: 90%
Published: Jul 15, 2026
Last Modified: Jul 15, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.