TI-2026-86050 CVE-2026-119758 · GHSA-c5rf-74mx-pffw
Path traversal and SSRF in ERPNext OCR lets users read files
Priority MEDIUM 64
ERPNext OCR app for Frappe/ERPNext through 1.1.1 contains a missing authorization and path traversal vulnerability that allows any authenticated user to read arbitrary server files by passing a fully client-controlled pa…