CVE Intelligence
Analysis AI-assisted

CVE-2026-39405: Frappe LMS Path Traversal via SCORM Package Upload

CVE-2026-39405 affects Frappe LMS versions 2.50.0 and below. A user with the course editing role could upload a SCORM ZIP package to write files outside the intended directory, a path traversal classified as CWE-22. The record states the issue is resolved in version 2.50.1, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Frappe LMS is a learning management system. According to the record, in versions 2.50.0 and below, a user with the course editing role could upload a SCORM ZIP package that wrote files outside the intended directory. The weakness is classified as CWE-22 (Path Traversal), and the record states it was resolved in version 2.50.1.

Impact

  • The GitHub CNA scores the issue 9.4 under CVSS 4.0, with High impact ratings for confidentiality, integrity and availability in the vector.
  • Because the write occurs outside the intended directory, an authenticated course editor could potentially modify files the application does not expose to that role. The real scope depends on the deployment and is not detailed in the record.

Affected products and versions

  • Product: Frappe LMS (frappe/lms).
  • Affected: versions 2.50.0 and below, as described in the record. The affected range listed is below 2.50.1.
  • Resolved: version 2.50.1, referenced by the GitHub release tag and the security advisory.

Exploitation status

CISA KEV does not list this CVE, and the sources consulted show no confirmed exploitation in the wild. The SSVC data in the record marks exploitation as none and automatable as no. The EPSS probability recorded is 0.00454, with a percentile of 0.3765.

Remediation and mitigation

  • Upgrade Frappe LMS to version 2.50.1 or later, which the record identifies as the resolved release.
  • Until the upgrade is applied, limit the course editing role to trusted users and review who can upload SCORM packages.
  • Review existing SCORM uploads and the server file system for unexpected files outside the expected application directories.

Detection guidance

  • Monitor application logs for SCORM package uploads by course editors and review unusual file names or destination paths.
  • Audit file-system changes in LMS application directories after content uploads.
  • Track role assignments and account activity for users holding course editing privileges.

Limitations of the available information

The record does not include technical root-cause details, the specific paths affected, or any proof of concept. The fixes field in the record is empty, but the release tag and advisory reference version 2.50.1. Consult the vendor advisory for full details before making decisions based on scope.

Frequently asked questions

Which Frappe LMS versions are affected by CVE-2026-39405?

The record describes versions 2.50.0 and below as affected, and lists the affected range as versions below 2.50.1.

Is CVE-2026-39405 known to be exploited in the wild?

CISA KEV does not list this CVE, and the sources consulted show no confirmed exploitation. The SSVC data in the record marks exploitation as none.

What should administrators do now?

Upgrade Frappe LMS to version 2.50.1 or later, limit the course editing role to trusted users, and review recent SCORM uploads and file-system changes.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.