Frappe ERPNext CVE-2025-66438

Requires an authenticated session whose role grants permission to create or modify a Print Format document in Frappe ERPNext (through version 15.89.0) - this is a customization/administrative privilege, not a default end-user capability, which is the primary limiting factor. The attacker must be able to place a Jinja expression in the Print Format html field and then invoke the frappe.www.printview.get_html_and_style() API against any renderable document (e.g., Supplier, Sales Invoice). Exploitation leverages the fact that get_safe_globals() exposes frappe.db.sql inside the SandboxedEnvironment; effective data impact therefore depends on what that exposed global permits in the deployment. No user interaction by a victim is needed, and the trigger is reachable over the network, but the permission requirement and the Jinja sandbox (which constrains the payload to exposed globals rather than full OS access) bound realistic impact toward database information disclosure.

Signals are largely consistent and point to a genuine, actionable vulnerability rather than an inflated high-CVSS artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U, 8.8) describes a network-reachable, low-complexity attack that nonetheless requires authentication (PR:L) - the description confirms this, stating the attacker must be an authenticated user with permission to create or modify a Print Format, which is typically an administrative/customization-level privilege and not granted to ordinary users. A public POC exists (two write-ups), which raises practical risk, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - exploitation status is 'publicly available exploit code exists,' which must not be conflated with in-the-wild attacks. Note a tension between the metadata and the technical reality: the Tags claim 'RCE,' but the description explains that ERPNext wraps Jinja2 in a SandboxedEnvironment and the demonstrated impact is information disclosure via the exposed frappe.db.sql global (database version, schema, sensitive values), not confirmed arbitrary OS command execution - treat the RCE label as unverified. The input's I:H/A:H depend on frappe.db.sql permitting write/destructive SQL, which is plausible but not explicitly demonstrated in the description (which emphasizes disclosure). Net: a real priority for ERPNext operators who allow delegated Print Format editing, but the authentication precondition meaningfully narrows the realistic attacker population compared to an unauthenticated flaw.

An authenticated user who has been delegated rights to customize Print Formats (e.g., a power user or junior admin) edits a Print Format and embeds a malicious Jinja expression in the html field invoking frappe.db.sql. They then call the frappe.www.printview.get_html_and_style() API against a target document such as a Supplier or Sales Invoice, triggering server-side template rendering that executes the injected query and returns database version, schema, or sensitive row data. A public proof-of-concept demonstrating this chain is available, lowering the effort required to reproduce it.