CVE-2025-66436 Details

A server-side template injection (SSTI) vulnerability has been identified in Frappe ERPNext versions through 15.89.0. The issue arises in the 'get_terms_and_conditions' method, where user-controlled Jinja2 templates are rendered using 'frappe.render_template()' with a context that can be manipulated by the user. Despite Frappe's use of a custom SandboxedEnvironment, several dangerous globals, including 'frappe.db.sql', are accessible via 'get_safe_globals()', allowing for potential exploitation. An authenticated attacker with the ability to create or modify Terms and Conditions documents can inject arbitrary Jinja expressions into the terms field, leading to unauthorized code execution on the server side within a limited but still risky context. This vulnerability could also be exploited to extract sensitive information from the database.