CVE-2025-66435 Details

A server-side template injection (SSTI) vulnerability has been identified in Frappe ERPNext versions through 15.89.0. The issue arises in the 'get_contract_template' method, where user-controlled Jinja2 templates are rendered using 'frappe.render_template()' with a context that can be manipulated by the user. Despite Frappe's implementation of a custom SandboxedEnvironment, several dangerous globals, including 'frappe.db.sql', remain accessible through 'get_safe_globals()', allowing for potential exploitation. An authenticated attacker with the ability to create or modify contract templates can inject arbitrary Jinja expressions into the 'contract_terms' field. This exploitation could lead to the execution of server-side code in a restricted but still hazardous context, with the possibility of leaking sensitive database information.