CVE Catalog
CVE-2026-39405
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk0.30%
23th percentile - higher than 23% of all known CVEs
Summary
In Frappe Learning Management System (LMS) versions 2.50.0 and below, a user with course editing role can upload a SCORM ZIP package to write files outside the intended directory. Fixed in version 2.50.1.
Risk Assessment
Risk of writing files to arbitrary locations on the server, potentially leading to code execution or system integrity compromise.
Recommendation
Update Frappe LMS to version 2.50.1 or later.
Original NVD description (English source)
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.50.0 and below, a user with course editing role could upload a SCORM ZIP package to write files outside the intended directory. This issue has been resolved in version 2.50.1.