The vulnerability is a server‑side template injection that occurs when user‑controlled message fields are rendered without validation. An attacker who can submit a message may inject malicious template expressions that execute in an unrestricted context, enabling arbitrary database reads and writes, deletion of documents, outbound network requests, and e‑mail sending from the server.

The affected product is Frappe ERPNext. Versions prior to 15.119.1 and prior to 16.32.0 in the 16.x series contain the flaw. These releases are vulnerable when the message interface is exposed to authenticated users with common operational roles.

The CVSS score of 8.7 indicates a high severity vulnerability. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, suggesting no confirmed public exploits yet. Exploitation requires an authenticated user with a common operational role who can supply a crafted message; the injection would allow the attacker to read or modify any database record, delete documents, initiate outbound connections from the server, and send arbitrary mail on behalf of the system.