This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-119758 | BDVDB-2026-401145 Detail

Monogrammerpnext_ocr

Description#

ERPNext OCR app for Frappe/ERPNext through 1.1.1 contains a missing authorization and path traversal vulnerability that allows any authenticated user to read arbitrary server files by passing a fully client-controlled path argument to the whitelisted read_document method. Attackers can supply local file paths to bypass Frappe's File doctype permission model and access other users' private uploads, or supply arbitrary URLs to trigger server-side requests reaching internal services and cloud metadata endpoints.

Impact#

Per CVSS v3.1: confidentiality impact high, integrity impact none, availability impact none. Attack vector: network.

Weaknesses#

  • CWE-918 Server-Side Request Forgery (SSRF)
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

References#

Exploit#

History#

  1. Version 1Record published in the CVE List.