CVE-2025-66434

Katalog CVE

CVSS 8.8 · High EPSS 0,59%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada frappe erpnext. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (body_text) using frappe.render_template() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals such as frappe.db.sql are still available in the execution context via get_safe_globals(). An authenticated attacker with access to configure Dunning Type and its child table Dunning Letter Text can inject arbitrary Jinja expressions, resulting in server-side code execution within a restricted but still unsafe context. This can leak database information.

Rincian

Terbit di NVD

15 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://iamanc.github.io/post/erpnext-ssti-bug-1 exploit · advisory pihak ketiga
• https://www.notion.so/SSTI-bug-1-239e6086eadc8096bfcfe90551a3a483?source=copy_link exploit · advisory pihak ketiga