https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 10 Nov 2026 05:47:11 +0000 https://db.gcve.eu/vuln/cve-2026-119758 <p><strong>Affected:</strong> Monogramm erpnext_ocr</p> <p>ERPNext OCR app for Frappe/ERPNext through 1.1.1 contains a missing authorization and path traversal vulnerability that allows any authenticated user to read arbitrary server files by passing a fully client-controlled path argument to the whitelisted read_document method. Attackers can supply local file paths to bypass Frappe&#39;s File doctype permission model and access other users&#39; private uploads, or supply arbitrary URLs to trigger server-side requests reaching internal services and cloud metadata endpoints.</p> <p><strong>Affected:</strong> Monogramm erpnext_ocr</p> <p>ERPNext OCR app for Frappe/ERPNext through 1.1.1 contains a missing authorization and path traversal vulnerability that allows any authenticated user to read arbitrary server files by passing a fully client-controlled path argument to the whitelisted read_document method. Attackers can supply local file paths to bypass Frappe&#39;s File doctype permission model and access other users&#39; private uploads, or supply arbitrary URLs to trigger server-side requests reaching internal services and cloud metadata endpoints.</p> https://db.gcve.eu/vuln/cve-2026-119758