An authenticated template injection vulnerability in ERPNext enables users with operational roles to execute arbitrary server-side code, resulting in total system compromise.

The application improperly neutralizes special elements in template engines (CWE-1336) within the process_statement_of_accounts module. An authenticated user can inject malicious expressions to execute code or access data, despite requiring prior authentication.

This vulnerability allows an attacker with legitimate system access to elevate their privileges and execute arbitrary code on the underlying host. The ability to read or modify data across the entire application, combined with the potential for remote code execution, presents a severe risk to organizational operations and data integrity.

Immediate Action: Update ERPNext to version 15.118.0, 16.29.0, or higher to ensure the template rendering logic is secured.

Proactive Monitoring: Monitor for anomalous server-side process execution or unexpected file system modifications originating from the ERPNext application account.

Compensating Controls: Restrict access to sensitive modules, such as account processing, to the minimum number of users required to perform business functions.

Public Exploit Available: Unknown

Administrators should update their ERPNext instances immediately to prevent internal threats from escalating to full system compromise. Review user roles and permissions to ensure that access to template-related functions is strictly controlled until the patch is applied.