ERPNext OCR app for Frappe/ERPNext contains a missing authorization check and a path traversal flaw in the read_document method, allowing any authenticated user to pass a fully controlled path and retrieve arbitrary server files. The same flaw also permits the attacker to supply arbitrary URLs, resulting in server‑side requests that can reach internal services, cloud metadata endpoints, or external resources. The combination of file system access and SSRF can be used to exfiltrate confidential data and gain further footholds inside the network.

The vulnerability affects Monogramm’s ERPNext OCR application, version 1.1.1 and any earlier releases. Hosts running these versions on the Frappe/ERPNext platform are susceptible, regardless of additional system or network configuration. No specific patch version is mentioned in the data.

The CVSS score of 7.1 indicates a medium‑to‑high risk level. With no EPSS score available and the vulnerability not listed in CISA KEV, the probability of exploitation is uncertain but the presence of authentication requirements and the ability to read sensitive files or reach internal services makes it a valuable target for adversaries. Attackers need an authenticated session but can then traverse the filesystem or trigger arbitrary outbound requests without further constraints.