ERPNext OCR 1.1.1 Path Traversal and SSRF via read_document

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

ERPNext OCR app for Frappe/ERPNext through 1.1.1 contains a missing authorization and path traversal vulnerability that allows any authenticated user to read arbitrary server files by passing a fully client-controlled path argument to the whitelisted read_document method. Attackers can supply local file paths to bypass Frappe's File doctype permission model and access other users' private uploads, or supply arbitrary URLs to trigger server-side requests reaching internal services and cloud metadata endpoints.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• vulncheck.com/…-ocr-path-traversal-and-ssrf-via-read-document Üçüncü taraf
• gist.github.com/behruz-svg/a51b0c18510aa0ecc18a6bc6014b0b19 İstismar kodu ya da analiz

Kayıt geçmişi

1. 6 Kas 2026 20:42Yayımlandı

İlgili açıklar

• 6,5 CVE-2026-108262DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885
• 10,0 CVE-2026-71495Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access
• 6,3 CVE-2026-75598Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization
• 5,0 CVE-2026-102356Kroki Mermaid companion SSRF via flowchart image URLs
• 7,5 CVE-2026-102359Kroki: TikZ Secure Mode Local File Read via LaTeX File I/O Primitives
• 8,2 CVE-2026-85743FreeScout: Server-side request forgery via incomplete outbound host validation and unguarded download sinks