External risk intelligence

ERPNext Unrestricted Template Injection Leading to Server-Side Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-72911

ERPNext is a web-based Enterprise Resource Planning application designed for business operations. Such platforms are commonly deployed as internet-facing web applications to provide remote access to users, making the interface reachable via the public internet in typical deployment scenarios.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in ERPNext, an open-source Enterprise Resource Planning tool, allowing authenticated users with common operational roles to execute arbitrary server-side code and access sensitive data. This issue arises from how the system processes template rendering, potentially impacting data confidentiality and integrity. The main concern is confirming relevance and exposure within your deployed ERPNext instances.

Allows code execution and data theft.
Critical for business data and operations.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An authenticated user with standard operational privileges can manipulate template fields within ERPNext. This manipulation allows for the injection of malicious expressions, leading to the execution of arbitrary code on the server and unauthorized access to sensitive application data.

Requires authenticated user access.
Triggers via template field manipulation.
Risk of code execution and data exposure.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an authenticated user with a common operational role could inject template expressions into ERPNext's statement of accounts processing. This could allow them to execute arbitrary server-side code and read sensitive application data.

ERPNext application data.
Via authenticated user template injection.
Arbitrary code execution and data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The ERPNext application, being a web-based ERP tool, likely falls under the responsibility of platform or infrastructure teams who manage its deployment and availability. System owners and security teams must collaborate to identify all instances of ERPNext, confirm their network exposure, and assess business criticality to prioritize remediation. Coordination with the vendor for patches or supported upgrade paths is essential.

Platform or infrastructure teams own the issue.
Verify network exposure and business criticality.
Plan vendor-coordinated upgrades or patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ERPNext?

ERPNext is a comprehensive, open-source Enterprise Resource Planning (ERP) software suite. Businesses use it to manage core operational functions such as accounting, inventory, human resources, and project tracking within a single, integrated platform.

What does CWE-1336 mean for CVE-2026-72911?

CWE-1336 refers to Improper Neutralization of Special Elements Used in a Template Engine. In this CVE, the vulnerability allows an authenticated user to inject malicious template expressions. Because the software fails to restrict access to internal system functions during rendering, these expressions can be elevated to execute arbitrary code on the underlying server.

How is this vulnerability triggered?

An attacker must have an authenticated account with common operational privileges to access specific template fields used for processing statements of accounts. The flaw does not trigger through public, unauthenticated access; the user must be logged into the application to input the malicious template expressions.

Is my instance relevant to this threat?

If you host an instance, you should care. Halo Surface Signal notes that because ERPNext is designed for remote business operations, it is frequently deployed as an internet-facing application. This makes your specific instance potentially reachable to attackers, increasing the priority of verifying your current software version.

What should I do to secure my deployment?

First, audit your environment to identify all active ERPNext instances and confirm their current version numbers. If you are running a version earlier than 15.118.0 or 16.29.0, prioritize upgrading to these patched releases immediately to remove the dangerous template rendering behavior.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.