ERPNext email templates use a server‑side rendering engine that evaluates template expressions. A user with the ability to create or edit those templates can craft expressions that are executed on the web‑server. The vulnerability allows an attacker to run arbitrary code, exfiltrate data, or compromise the system entirely. This is an instance of improper code generation via template injection, identified as CWE‑94.

The flaw is present in ERPNext v15.103.1 and earlier releases. No other products or vendors are listed as affected by this CVE. Organizations using legacy ERPNext installations should verify that their instance does not fall within the vulnerable version range.

The vulnerability is assigned a critical CVSS score of 9.8, reflecting a high potential for system compromise. It has an EPSS score of <1%, indicating a low probability of exploitation currently, and it is not listed in the CISA KEV catalog. The attack vector requires the attacker to have permission to create or edit email templates; once authorized, the vulnerability can be triggered with minimal effort. If successful, the attacker could execute arbitrary server‑side code, leading to full system compromise.