CVE-2026-35404

A vulnerability in the Open edX platform allows authenticated Enterprise Admin users to supply any URL via the metadata_url POST parameter. This URL is passed directly without validation, enabling an attacker to force the server to make HTTP requests to internal network services or malicious endpoints.

Vulnerability in Open edX Platform allows a course author or staff user with import permission to bypass path validation in _is_bad_path, which compares paths using startswith instead of comparing path components. A crafted .tar.gz archive can escape into a sibling course staging directory, causing limited cross-tenant file corruption.

Vulnerability in Open edX Platform involves lack of sanitization of discussion-title values in add_additional_attributes_to_notifications, allowing an enrolled student to place CSS-capable markup in post titles. This markup is rendered as safe HTML in email digests, enabling email-open tracking and content spoofing or phishing.

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files[].url, performs a server-side fetch using "requests.get(url, allow_redirects=True)". The fetched bytes are then returned inside a ZIP response. This enables SSRF with response exfiltration. Redirect-following is enabled, and there is no timeout in the vulnerable fetch path. This issue has been patched via commit 00b7c3c.

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who captures a valid LTI launch request to replay it an unlimited number of times without detection. This issue has been patched via commit 3a5ac85.

Open edX Platform prior to commit 59bb6d6 has a vulnerability in the set_course_mode_price() function, which is protected only by @login_required and performs no course-level permission check. Any authenticated user, including a learner account with zero course roles, can issue a single POST request to overwrite the honor mode price and currency of any course on the platform.

In Open edX Platform from the maple release to ulmo, an unauthenticated attacker can fully bypass the email verification process. This exploits OAuth2 tokens issued to inactive users and the exposure of activation_key in the REST API response.