Executive brief
Frappe Learning Management System (LMS) is a platform used to organize and deliver educational content. A security flaw allows users with course-editing permissions to upload malicious files that can escape their intended storage area and overwrite critical system files. This could lead to a complete takeover of the server or a total disruption of the learning platform's services.
Technical details
A path traversal vulnerability (CWE-22) exists in Frappe LMS versions up to and including 2.50.0. The vulnerability is located in the SCORM ZIP package upload functionality, where the application fails to properly validate extraction paths. An authenticated attacker with course-editing privileges can craft a malicious ZIP archive containing 'dot-dot-slash' (../) sequences to write arbitrary files to the underlying file system. This can result in remote code execution if the attacker overwrites executable scripts or configuration files. The issue is resolved in version 2.50.1 by validating that extraction paths remain within the designated SCORM directory.
Affected products
- Frappe Learning Management System (LMS) <= 2.50.0
Timeline
- 2026-03-30: patched: Version 2.50.1 released to address the vulnerability.
- 2026-05-15: advisory: GitHub Security Advisory GHSA-mxh7-g3r7-g96h published.
- 2026-05-20: disclosed: CVE-2026-39405 published to the NVD.