The vulnerability allows an authenticated user with a common operational role to inject server‑side template expressions into the subject, body, or pdf_name fields of a Process Statement of Accounts. Because the validate_template and render_template functions were called with unrestricted global variables, the injected expressions can execute arbitrary server‑side code and read data throughout the application. This flaw is classified as a Server‑Side Template Injection (CWE-1336) and carries a CVSS v3.1 score of 9.9, indicating critical severity.

ERPNext sites running any version of the ERPNext code base prior to the release of 15.118.0 for the 15.x series and 16.29.0 for the 16.x series are affected. The vulnerability is present in the erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py module, which is part of the standard ERPNext deployment.

Because the flaw requires only an authenticated user with a common operational role, the attack vector is likely a legitimate login followed by an editor of statement documents. The CVSS score of 9.9 reflects the high impact and ease of exploitation. The EPSS score is not available, so the current probability of active exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, but the combination of high severity, wide applicability, and the required authentication means that the risk to organizations remains significant.