Is there a patch available for CVE-2026-44445?

Yes, a patch is available for CVE-2026-44445. Update the affected software to the latest version immediately.

ERPNext CVE-2026-44445

Q: What is the CVSS score of CVE-2026-44445?

CVE-2026-44445 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-30196 MEDIUM

Improper Restriction of XML External Entity Reference (CWE-611)

2026-05-13 GitHub_M

XXE Erpnext

5.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:13 vuln.today

Patch available

May 13, 2026 - 23:17 EUVD

CVSS changed

May 13, 2026 - 22:22 NVD

5.3 (MEDIUM)

CVE Published

May 13, 2026 - 21:17 nvd

UNKNOWN (no severity yet)

DescriptionGitHub Advisory

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.12.0, an improper restriction of XML external entity (XXE) reference vulnerability in the EDI Module enables an authenticated attacker to read files from the local file system, including sensitive configuration files. This vulnerability is fixed in 15.104.3 and 16.12.0.

AnalysisAI

XML External Entity (XXE) injection in ERPNext's EDI Module allows authenticated low-privilege attackers to read arbitrary files from the server's local filesystem, including sensitive configuration files that may contain database credentials or API keys. Affected are all ERPNext installations on the v15 branch prior to 15.104.3 and on the v16 branch prior to 16.12.0 (cpe:2.3:a:frappe:erpnext:*). No public exploit identified at time of analysis, EPSS exploitation probability sits at 0.06% (18th percentile), and CISA SSVC assesses exploitation as none and the attack as non-automatable - collectively placing this at lower operational priority despite its network-accessible attack vector.

Technical ContextAI

CWE-611 (Improper Restriction of XML External Entity Reference) arises when an XML parser resolves external entity declarations - constructs of the form <!ENTITY xxe SYSTEM 'file:///etc/passwd'> - without disabling that feature. ERPNext's EDI (Electronic Data Interchange) module is the vulnerable surface: EDI workflows routinely process XML-formatted trade documents (invoices, purchase orders, ASNs), and if the underlying XML parser is not configured to forbid external entity resolution, a crafted document can cause the server process to open and return the contents of any file readable by the application's OS user. The affected package is frappe/erpnext (CPE cpe:2.3:a:frappe:erpnext:*) running on the Frappe framework. The confidentiality impact is scoped to the vulnerable component (VC:L, SC:N in CVSS 4.0), meaning lateral escape to other systems is not indicated.

RemediationAI

Upgrade ERPNext to version 15.104.3 (v15 branch) or 16.12.0 (v16 branch) as the primary remediation; these are the vendor-confirmed fixed releases per GitHub Security Advisory GHSA-mhm9-75w7-423r (https://github.com/frappe/erpnext/security/advisories/GHSA-mhm9-75w7-423r). If immediate upgrade is not feasible, restrict access to the EDI Module to only users who operationally require it via ERPNext's role-based permission system - this reduces the authenticated attack surface without disabling the module globally. Additionally, enforce network-layer controls so that ERPNext is not directly accessible from untrusted networks, limiting unanticipated authenticated sessions. Note that disabling the EDI Module entirely will interrupt any active EDI-based procurement or logistics workflows; coordinate with business stakeholders before applying that workaround.