CVE-2026-55242 ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix
Authenticated users can exploit Server-Side Template Injection in ERPNext to execute code and access unauthorized data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-55242?
CVE-2026-55242 is a high-severity code injection vulnerability in frappe erpnext, published on 15 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can trigger server-side template injection through a configuration field, resulting in unauthorized disclosure of data outside the user's normal permission scope. This issue is fixed in versions 15.111.0 and 16.22.0.
Which versions are affected by CVE-2026-55242?
How do I fix CVE-2026-55242?
No fix has been published for CVE-2026-55242 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-55242 being exploited?
There is no known exploitation of CVE-2026-55242 in the wild and no public exploit code.
Sources
Also known as GHSA-pxf3-4gvc-v45j.