CVE-2026-55242 — ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix

CVE-2026-55242

ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix PUBLISHED

Description (CNA)

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can trigger server-side template injection through a configuration field, resulting in unauthorized disclosure of data outside the user's normal permission scope. This issue is fixed in versions 15.111.0 and 16.22.0.

Affected (CNA)

Vendor / product	Versions
frappe / erpnext	affected < 15.111.0; affected >= 16.0.0, < 16.22.0

CWE

CWE-863, CWE-1336

References

https://github.com/frappe/erpnext/security/advisories/GHSA-pxf3-4gvc-v45j

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.