ERPNext CVE-2026-44445

Authentication is required: the CVSS 4.0 vector specifies PR:L (low-privilege authenticated access), meaning an attacker must hold a valid ERPNext account of any role. The vulnerable code path is specifically within the EDI Module - exploitation is conditional on that module being in use and accessible to the attacker's account role; installations that have not deployed or enabled EDI functionality are not exposed via this vector. No additional non-default configuration is required beyond the EDI Module being active. Factors limiting exploitation include: (1) authenticated access requirement eliminates unauthenticated internet scanners, (2) SSVC automatable=no indicates the attack path is not trivially scriptable at scale, and (3) the impact is read-only confidentiality (VI:N, VA:N), preventing direct data destruction or service disruption.

The CVSS 4.0 base score of 5.3 (Medium) reflects a network-reachable (AV:N), low-complexity (AC:L), no-prerequisite-condition (AT:N) attack requiring only low-privilege authentication (PR:L) with no user interaction (UI:N). The impact is limited to partial confidentiality of the vulnerable component (VC:L) with no integrity or availability consequence. EPSS at 0.06% (18th percentile) indicates very low near-term exploitation probability compared to all scored CVEs, consistent with CISA SSVC's assessments of exploitation=none and automatable=no - the latter suggesting exploitation requires attacker-specific knowledge of the EDI module's XML ingestion path rather than a generic spray-and-pray approach. There is no KEV listing and no confirmed POC. The primary real-world risk is credential harvesting: local config files in Frappe/ERPNext deployments typically contain database passwords and secret keys, meaning a successful read of site_config.json or similar could enable privilege escalation beyond the ERPNext application. Overall this is a genuine but lower-urgency finding: prioritize remediation in internet-exposed deployments or where ERPNext users include untrusted or external parties.

An attacker with a valid low-privilege ERPNext account - such as a supplier portal user or a recently on-boarded employee - navigates to the EDI Module and submits a crafted XML document containing an external entity declaration referencing a local file path such as /home/frappe/frappe-bench/sites/[site]/site_config.json. The server's XML parser resolves the entity and the application returns the file's contents in its response, exposing the database password and Frappe secret key stored in that configuration file. No POC has been publicly confirmed, but the attack technique for CWE-611 is well-documented and requires no specialized tooling.