CVE-2026-39405
A flaw in Frappe Learning Management System allows users with course editing rights to upload a SCORM ZIP package that can write files outside the intended directory. This can lead to unauthorized file creation or modification. The issue is fixed in version 2.50.1.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Frappe Learning Management System (LMS) versions 2.50.0 and earlier, specifically users who have the course editing role.
Real-world impact
An attacker could place arbitrary files on the server, potentially overwriting critical files, injecting malicious code, or exposing sensitive data.
Why this severity
The CVSS score of 9.4 reflects the combination of high confidentiality, integrity, and availability impact, low attack complexity, and the ability for an attacker to act without authentication. The vulnerability allows local file write outside the intended directory, which is a severe risk.
What to do about it
- 01Upgrade Frappe LMS to version 2.50.1 or later.
- 02Restart the LMS service after the upgrade.
NVD-referenced vendor advisory
Timeline
- May 20, 2026 · May 20, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 25, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.