ERPNext XML External Entity Reference Vulnerability in EDI Module Allowing File Read

A vulnerability allowing improper restriction of XML external entity (XXE) references has been identified in the EDI Module of ERPNext, an open-source Enterprise Resource Planning tool. This vulnerability affects versions prior to 15.104.3 and 16.12.0, and enables authenticated attackers to read files from the local file system, including sensitive configuration files. The issue has been addressed in the latest releases of ERPNext.

Impact

Exploitation of this vulnerability allows authenticated attackers to read local files, potentially including sensitive configuration information.

Remediation

Users are advised to upgrade to ERPNext versions 15.104.3 or 16.12.0.