Loading vulnerability…
Frappe LMS SCORM Upload Path Traversal
CVE-2026-39405 is a path traversal vulnerability in Frappe Learning Management System (LMS) SCORM package upload handling. In versions 2.50.0 and earlier, the application incorporates a user-controlled course chapter title into the destination path used to extract a ZIP-based SCORM package without adequate path sanitization. A course editor can supply traversal sequences in the chapter title, causing archive contents to be written outside the intended public-assets directory. This can permit overwriting of LMS application files and can lead to remote code execution when an overwritten server-side component is invoked.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated attacker with course-editing privileges can write attacker-controlled files to filesystem locations outside the intended SCORM asset directory. Where the LMS application installation is writable by the service account, the attacker may overwrite application code, including API handlers, and obtain remote operating-system command execution in the context of the LMS service. Successful exploitation can therefore compromise confidentiality, integrity, and availability of the LMS server and potentially affect downstream systems reachable with the compromised service account.
If you can’t patch tonight, do this now.
Until the upgrade is complete, disable or restrict SCORM package uploads and limit course-editing permissions to highly trusted administrators. Ensure the LMS runtime account does not have write permission to application source-code directories and deploy filesystem integrity monitoring for application code. Review SCORM upload activity and verify the integrity of server-side application files.
Patch, then assume compromise.
Upgrade Frappe LMS to version 2.50.1 or later, which resolves the unsafe extraction-path handling. Confirm that all LMS instances, including container images and non-production deployments, are updated and that application directories are restored from trusted packages if compromise is suspected.
No public exploits tracked yet. Mallory keeps watching.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.