Is CVE-2026-72908 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-72908?

CVE-2026-72908 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-72908

Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py constructs an SQL WHERE clause from request-influenced posting_date and args values, allowing an authenticated low-privilege user to inject SQL and extract sensitive information. This issue is fixed in versions 15.109.0 and 16.20.0.