Robinroy03

An issue exists in file-upload handling where the destination path is not validated before writing to disk. This allows authenticated attackers to perform path traversal, which is a method of accessing files and directories that are restricted from the user, by uploading crafted files to locations outside the intended storage directory to achieve remote code execution on the server.

The system fails to verify if a user account is disabled before dispatching Document Follow email notifications. Consequently, users whose accounts have been disabled continue to receive email updates regarding activity on documents they previously followed, despite their access being revoked.

An access control bypass exists in the REST API of the Frappe framework. When a document references another document via a Link field, the system fails to consistently enforce the permissions of the linked DocType during record retrieval. This allows a low-privileged authenticated user to read data and obtain fields from linked records that are outside their authorized scope.