ERPNext’s EDI Module suffers from an improper restriction of XML External Entity references. An authenticated attacker can exploit this flaw to read arbitrary files on the server, potentially exposing sensitive configuration data and other confidential information. The vulnerability is a classic XXE flaw (CWE‑611) that enables file read access without additional permissions, directly endangering the confidentiality of the system’s internals.

The issue affects ERPNext deployments using the EDI module on versions older than 15.104.3 and 16.12.0. The affected product is the frappe:erpnext platform, specifically its EDI processing component.

The CVSS score of 5.3 indicates moderate severity. Because the flaw requires an authenticated user, the attack vector is limited to legitimate accounts, and the exploitation likelihood is moderate pending any publicly available exploitation tools. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. However, the availability of the flaw in widely used ERP solutions raises awareness of the moderate risk for organizations relying on older versions.