CVE-2026-72908

Published: Aug 10, 2026Modified: Sep 8, 2026Deferred

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py constructs an SQL WHERE clause from request-influenced posting_date and args values, allowing an authenticated low-privilege user to inject SQL and extract sensitive information. This issue is fixed in versions 15.109.0 and 16.20.0.

Related CWEs

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (7)

https://github.com/frappe/erpnext/commit/2a91c7229a47ac6a5bb2d8227290b03415bf8baf

Source: security-advisories@github.com

https://github.com/frappe/erpnext/commit/c45d2a348777a9bdf697832b6ca129d2f0626fd2

Source: security-advisories@github.com

https://github.com/frappe/erpnext/commit/f98975f51a62d611f536368671c3dbaf81d61eb9

Source: security-advisories@github.com

https://github.com/frappe/erpnext/pull/55127

Source: security-advisories@github.com

https://github.com/frappe/erpnext/releases/tag/v15.109.0

Source: security-advisories@github.com

https://github.com/frappe/erpnext/releases/tag/v16.20.0

Source: security-advisories@github.com

https://github.com/frappe/erpnext/security/advisories/GHSA-grhp-m55m-63f8

Source: security-advisories@github.com

Timeline

No history available yet.