CVE-2026-44445 ERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI Module
An authenticated attacker can exploit an XML External Entity vulnerability in the EDI module to read sensitive local files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-44445?
CVE-2026-44445 is a medium-severity vulnerability in Frappe Erpnext, published on 13 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.12.0, an improper restriction of XML external entity (XXE) reference vulnerability in the EDI Module enables an authenticated attacker to read files from the local file system, including sensitive configuration files. This vulnerability is fixed in 15.104.3 and 16.12.0.
Weakness: CWE-611
Which versions are affected by CVE-2026-44445?
It affects 1 product.
Products include Frappe Erpnext.
How do I fix CVE-2026-44445?
No fix has been published for CVE-2026-44445 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-44445 being exploited?
There is no known exploitation of CVE-2026-44445 in the wild and no public exploit code.
Other vulnerabilities in Frappe Erpnext
Sources
Also known as GHSA-mhm9-75w7-423r.