ERPNext Server-Side Template Injection Vulnerability in Email Template Rendering

A Server-Side Template Injection (SSTI) vulnerability exists in ERPNext versions through 15.103.1. This issue allows an attacker with the ability to create or edit email templates to inject template expressions. These expressions are executed on the server when the template is rendered, potentially leading to unauthorized actions or information disclosure.

Impact

Exploitation of this vulnerability allows for Server-Side Template Injection, where injected template expressions are executed on the server during template rendering. This could lead to arbitrary code execution or other malicious actions, depending on the injected content.