Chained Frappe LMS Flaws Enable Student-Level Remote Code Execution
Vulnerability Disclosure · 2 sources · Updated 2mo ago · First seen May 14, 2026
Rhino Security Labs disclosed multiple vulnerabilities in Frappe LMS that can be chained to give a student-level attacker remote code execution on the LMS server after an administrator views the attacker’s profile. The chain combines stored cross-site scripting in profile bio previews, tracked as CVE-2026-34606, with a SCORM-upload path traversal flaw, CVE-2026-39405, allowing a privileged course creator to write extracted archive content outside the intended assets directory and overwrite application files.
The stored XSS stems from BeautifulSoup get_text() concatenating otherwise benign text fragments into executable HTML without re-sanitizing the output. Researchers also reported CVE-2026-46546, a meta-tag injection flaw that enables open redirects. Frappe LMS v2.44.0 was confirmed vulnerable; the issues are fixed in v2.50.1, and organizations should upgrade promptly and review LMS servers for unauthorized file changes or suspicious profile content.
