ERPNext versions older than 15.111.0 and 16.22.0 allow a server‑side template injection (SSTI) vulnerability when the Stock Settings field "naming_series_prefix" is altered. The injection can be performed by any authenticated user who has a standard operational role but is not otherwise privileged. This weakness can cause the system to evaluate arbitrary template expressions, giving the attacker read access to data that normally would be protected by the user’s permission scope, thereby leading to serious confidentiality breaches.

The affected product is ERPNext from the frappe:erpnext vendor. The vulnerability applies to all releases before 15.111.0 and 16.22.0. Users running these older revisions are at risk and should verify their installation version.

The CVSS base score of 8.8 indicates high severity, and the EPSS score of less than 1% indicates a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated session with a standard operational role, inferred from the description that the flaw is triggered through a configuration field. An attacker would need to modify the "naming_series_prefix" setting within the Stock Settings configuration interface and then cause the system to render it with the templating engine, which can make an attacker read arbitrary sensitive data outside their normal access rights.