Filtered by vendor Monogramm Subscriptions
Total 1 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-119758 1 Monogramm 1 Erpnext Ocr 2026-11-07 6.5 Medium
ERPNext OCR app for Frappe/ERPNext through 1.1.1 contains a missing authorization and path traversal vulnerability that allows any authenticated user to read arbitrary server files by passing a fully client-controlled path argument to the whitelisted read_document method. Attackers can supply local file paths to bypass Frappe's File doctype permission model and access other users' private uploads, or supply arbitrary URLs to trigger server-side requests reaching internal services and cloud metadata endpoints.