Is CVE-2026-85272 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85272 being exploited in the wild.

How severe is CVE-2026-85272?

Medium severity, with a CVSS score of 4.3, published 18 September 2026.

Which products and versions are affected?

Open edX Platform Aspen.1 through Ulmo (fixed in Ulmo and Verawood.1).

Is there a fix for CVE-2026-85272?

A patch was published on 2026-09-18: Fixed in Ulmo and Verawood.1 releases Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85272 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-85272?

Check whether you run Open edX Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85272: Open edX Platform path traversal in archive extraction

CVE-2026-85272 · Severity: medium · CVSS 4.3 · Published 2026-09-18

Open edX is a learning management platform used to author and deliver online courses. A course author or staff member with import permissions can upload a specially crafted archive file that escapes into a sibling course directory, potentially corrupting files in another course's staging area. The impact is limited to cross-tenant data corruption rather than arbitrary file access or code execution.

Technologies: Open edX Platform. Vendors: Open edX.

Quick answers

Is CVE-2026-85272 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85272 being exploited in the wild.
How severe is CVE-2026-85272?: Medium severity, with a CVSS score of 4.3, published 18 September 2026.
Which products and versions are affected?: Open edX Platform Aspen.1 through Ulmo (fixed in Ulmo and Verawood.1).
Is there a fix for CVE-2026-85272?: A patch was published on 2026-09-18: Fixed in Ulmo and Verawood.1 releases Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85272 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-85272?: Check whether you run Open edX Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in openedx/core/lib/extract_archive.py where the safe_extractall function validates extraction targets using string prefix comparison (startswith) instead of proper path component comparison. An attacker with course import permission can craft a .tar.gz archive where a member shares the base64 directory prefix with a sibling staging directory, causing the extraction to escape and corrupt files. A fix replaces the string-prefix check with commonpath to enforce proper directory boundaries.

Affected products

Open edX Open edX Platform Aspen.1 through Ulmo (fixed in Ulmo and Verawood.1)

Timeline

2026-09-18: disclosed
2026-09-18: patched: Fixed in Ulmo and Verawood.1 releases

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.