Executive brief
Open edX is a learning management platform used to author and deliver online courses. A course author or staff member with import permissions can upload a specially crafted archive file that escapes into a sibling course directory, potentially corrupting files in another course's staging area. The impact is limited to cross-tenant data corruption rather than arbitrary file access or code execution.
Technical details
The vulnerability exists in openedx/core/lib/extract_archive.py where the safe_extractall function validates extraction targets using string prefix comparison (startswith) instead of proper path component comparison. An attacker with course import permission can craft a .tar.gz archive where a member shares the base64 directory prefix with a sibling staging directory, causing the extraction to escape and corrupt files. A fix replaces the string-prefix check with commonpath to enforce proper directory boundaries.
Affected products
- Open edX Open edX Platform Aspen.1 through Ulmo (fixed in Ulmo and Verawood.1)
Timeline
- 2026-09-18: disclosed
- 2026-09-18: patched: Fixed in Ulmo and Verawood.1 releases