CVE-2025-66438
ERPNext Frappe Server-Side Template Injection Vulnerability
Description
A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism. Specifically, the API frappe.www.printview.get_html_and_style() triggers the rendering of the html field inside a Print Format document using frappe.render_template(template, doc) via the get_rendered_template() call chain. Although ERPNext wraps Jinja2 in a SandboxedEnvironment, it exposes sensitive functions such as frappe.db.sql through get_safe_globals(). An authenticated attacker with permission to create or modify a Print Format can inject arbitrary Jinja expressions into the html field. Once the malicious Print Format is saved, the attacker can call get_html_and_style() with a target document (e.g., Supplier or Sales Invoice) to trigger the render process. This leads to information disclosure from the database, such as database version, schema details, or sensitive values, depending on the injected payload. Exploitation flow: Create a Print Format with SSTI payload in the html field; call the get_html_and_style() API; triggers frappe.render_template(template, doc) inside get_rendered_template(); leaks database information via frappe.db.sql or other exposed globals.
INFO
Published Date :
Dec. 15, 2025, 6:15 p.m.
Last Modified :
Oct. 14, 2026, 1:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | CRITICAL | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | ||||
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update Frappe ERPNext to the latest version.
- Apply vendor security patches promptly.
- Review and restrict Print Format creation permissions.
- Sanitize user input used in templates.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-66438.
| URL | Resource |
|---|---|
| https://iamanc.github.io/post/erpnext-ssti-bug-5 | Exploit Third Party Advisory |
| https://www.notion.so/SSTI-bug-5-239e6086eadc80a48f17c1257a604d2c?source=copy_link | Exploit Third Party Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-66438 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-66438
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-66438 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-66438 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 14, 2026
Action Type Old Value New Value Added Translation Title: Frappe ERPNext, Description: Una vulnerabilidad de inyección de plantillas del lado del servidor (SSTI) existe en el mecanismo de renderizado de formato de impresión de Frappe ERPNext hasta la versión 15.89.0. Específicamente, la API frappe.www.printview.get_html_and_style() activa el renderizado del campo html dentro de un documento de formato de impresión usando frappe.render_template(template, doc) a través de la cadena de llamadas get_rendered_template(). Aunque ERPNext envuelve Jinja2 en un SandboxedEnvironment, expone funciones sensibles como frappe.db.sql a través de get_safe_globals(). Un atacante autenticado con permiso para crear o modificar un formato de impresión puede inyectar expresiones Jinja arbitrarias en el campo html. Una vez que se guarda el formato de impresión malicioso, el atacante puede llamar a get_html_and_style() con un documento objetivo (por ejemplo, Proveedor o Factura de Venta) para activar el proceso de renderizado. Esto lleva a la revelación de información de la base de datos, como la versión de la base de datos, detalles del esquema o valores sensibles, dependiendo de la carga útil inyectada. Flujo de explotación: Crear un formato de impresión con carga útil SSTI en el campo html; llamar a la API get_html_and_style(); activa frappe.render_template(template, doc) dentro de get_rendered_template(); filtra información de la base de datos a través de frappe.db.sql u otras globales expuestas. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'n/a', 'product': 'n/a', 'versions': [{'status': 'affected', 'version': 'n/a'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-66438', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2025-12-16T14:55:58.539106Z'} -
Initial Analysis by [email protected]
Jan. 05, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-94 Added CPE Configuration OR *cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:* versions up to (including) 15.89.0 Added Reference Type MITRE: https://iamanc.github.io/post/erpnext-ssti-bug-5 Types: Exploit, Third Party Advisory Added Reference Type MITRE: https://www.notion.so/SSTI-bug-5-239e6086eadc80a48f17c1257a604d2c?source=copy_link Types: Exploit, Third Party Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Dec. 16, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-1336 -
New CVE Received by [email protected]
Dec. 15, 2025
Action Type Old Value New Value Added Description A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism. Specifically, the API frappe.www.printview.get_html_and_style() triggers the rendering of the html field inside a Print Format document using frappe.render_template(template, doc) via the get_rendered_template() call chain. Although ERPNext wraps Jinja2 in a SandboxedEnvironment, it exposes sensitive functions such as frappe.db.sql through get_safe_globals(). An authenticated attacker with permission to create or modify a Print Format can inject arbitrary Jinja expressions into the html field. Once the malicious Print Format is saved, the attacker can call get_html_and_style() with a target document (e.g., Supplier or Sales Invoice) to trigger the render process. This leads to information disclosure from the database, such as database version, schema details, or sensitive values, depending on the injected payload. Exploitation flow: Create a Print Format with SSTI payload in the html field; call the get_html_and_style() API; triggers frappe.render_template(template, doc) inside get_rendered_template(); leaks database information via frappe.db.sql or other exposed globals. Added Reference https://iamanc.github.io/post/erpnext-ssti-bug-5 Added Reference https://www.notion.so/SSTI-bug-5-239e6086eadc80a48f17c1257a604d2c?source=copy_link