EUVD-2026-118390

ERPNext OCR app for Frappe/ERPNext through 1.1.1 contains a missing authorization and path traversal vulnerability that allows any authenticated user to read arbitrary server files by passing a fully client-controlled path argument to the whitelisted readdocument method. Attackers can supply loca...

CVE-2026-119758

The ERPNext OCR app for Frappe/ERPNext (through version 1.1.1 ) is vulnerable to a missing authorization and path traversal vulnerability within the whitelisted read_document method. An authenticated user can provide a fully client-controlled path argument to read arbitrary server files, effectiv...