LearnHouse CVE-2025-12268

Exploitation requires authenticated access to LearnHouse (CVSS PR:L confirms user authentication is mandatory). The attacker must either possess valid credentials (account holder) or compromise an existing user account. The /api/v1/courses/ endpoint must be network-reachable from the attacker's location. The vulnerability is not exploitable by unauthenticated remote users. No special configuration or non-default deployment mode is required; the vulnerability exists in all versions up to the specified commit. However, the practical impact depends on whether the upload directory is web-accessible and configured to execute uploaded files - if uploads are stored outside the webroot or served with execution disabled, the attack may be contained to information disclosure (unauthorized file storage) rather than code execution.

Multiple risk signals present conflicting severity indicators. CVSS 2.1 (very low) and EPSS 0.06% percentile 18 (negligible real-world exploitation probability) suggest minimal immediate risk in most deployments. However, this is contradicted by the confirmed existence of publicly available exploit code and disclosure of the vulnerability to vendors. The CVSS vector reveals AV:N (network-exploitable) and AC:L (low attack complexity), but PR:L (requires login) acts as a significant practical barrier, limiting realistic attack scope to authenticated users or compromised accounts. The low impact scores (VC:L/VI:L/VA:L) indicate confidentiality, integrity, and availability each limited to low impact. The lack of vendor response and rolling release model means no upstream fix timeline exists, creating indefinite exposure for organizations unable to fork and patch independently. Risk profile is low for most users but medium-high for organizations with weak account security or insider threat concerns. The mismatch between 'public POC exists' and 'EPSS 0.06%' suggests this is a low-severity vulnerability with niche exploitability rather than widespread automated exploitation potential.

An authenticated LearnHouse user (legitimate account holder or attacker with compromised credentials) navigates to the course management interface and sends a crafted HTTP request to /api/v1/courses/ with a malicious file (e.g., PHP webshell, image with embedded malware) in the thumbnail parameter, bypassing file type validation. The file is stored on the server without restriction. If the uploads directory is web-accessible and configured to execute scripts, the attacker can trigger the malicious file to achieve remote code execution or data exfiltration. Public exploit code referenced in the NVD gist demonstrates this attack flow.