ERPNext is affected by a server‑side template injection flaw that allows malicious users to inject arbitrary template content. Because the rendering engine is exposed without restrictive safeguards, an attacker can execute code on the server. The vulnerability is only reachable by authenticated users who possess a limited set of permissions, but those permissions grant the ability to cross a permission boundary, thereby compromising the confidentiality, integrity, and availability of the application.

The affected product is ERPNext, built on the frappe framework. All releases prior to 15.111.0 and 16.22.0 are vulnerable, regardless of the operating environment. Users running any of those legacy versions should review their installed version against the published patch releases.

With a CVSS score of 9.9 the issue is classified as critical. The EPSS score is not available, but the absence of a public exploit does not diminish the high risk inherent to remote code execution. The vulnerability is not currently listed in the CISA KEV catalog, yet the potential impact and the required attacker conditions—an authenticated user with certain permissions—make it a top priority for remediation. The attack vector is inferred to be a privilege‑escalation scenario that relies on the application’s template engine and user permissions rather than an external network exploit.