CVE-2026-39405: Frappe LMS path traversal in SCORM ZIP upload

CVE-2026-39405 · Severity: info · CVSS 9.4 · Published 2026-05-20

Frappe Learning Management System (LMS) is a platform used to organize and deliver educational content. A security flaw allows users with course-editing permissions to upload malicious files that can escape their intended storage area and overwrite critical system files. This could lead to a complete takeover of the server or a total disruption of the learning platform's services.

Technologies: Frappe Technologies LMS. Vendors: Frappe Technologies.

Quick answers

Is CVE-2026-39405 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-39405 being exploited in the wild.
How severe is CVE-2026-39405?
Informational severity, with a CVSS score of 9.4, published 20 May 2026.
Which products and versions are affected?
Frappe Technologies LMS <= 2.50.0.
Is there a fix for CVE-2026-39405?
A patch was published on 2026-03-30: Version 2.50.1 released to address the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39405 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-39405?
Check whether you run Frappe Technologies LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in Frappe LMS versions up to and including 2.50.0. The vulnerability is located in the SCORM ZIP package upload functionality, where the application fails to properly validate extraction paths. An authenticated attacker with course-editing privileges can craft a malicious ZIP archive containing 'dot-dot-slash' (../) sequences to write arbitrary files to the underlying file system. This can result in remote code execution if the attacker overwrites executable scripts or configuration files. The issue is resolved in version 2.50.1 by validating that extraction paths remain within the designated SCORM directory.

Affected products

  • Frappe Learning Management System (LMS) <= 2.50.0

Timeline

  • 2026-03-30: patched: Version 2.50.1 released to address the vulnerability.
  • 2026-05-15: advisory: GitHub Security Advisory GHSA-mxh7-g3r7-g96h published.
  • 2026-05-20: disclosed: CVE-2026-39405 published to the NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.