ERPNext email templates use a server‑side rendering engine that evaluates template expressions. A user with the ability to create or edit those templates can craft expressions that are executed on the web‑server. The vulnerability allows an attacker to run arbitrary code, exfiltrate data, or compromise the system entirely. This is an instance of improper code generation via template injection, identified as CWE‑94.

The flaw is present in ERPNext v15.103.1 and earlier releases. No other products or vendors are listed as affected by this CVE. Organizations using legacy ERPNext installations should verify that their instance does not fall within the vulnerable version range.

No CVSS or EPSS scores are available and the vulnerability is not listed in the CISA KEV catalog, but the impact level is high. The attack vector requires the attacker to have permission to edit email templates; once authorized, the vulnerability can be triggered with minimal effort. If successful, the attacker could execute arbitrary server‑side code, leading to full system compromise.