CVE-2026-38431
ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject template expression…
Published: 2026-05-05 · CVSS: 9.8 · CVSS 3.1
ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject template expressions that are executed on the server when the template is rendered.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7