LearnHouse
CVE-2025-12276
LOW
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid LearnHouse credentials
-
DeliveryAuthenticate to LearnHouse
-
ExploitCraft malicious Image Handler request
-
ExecutionRetrieve unauthorized image metadata or files
-
ImpactExfiltrate sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authentication is required - the CVSS vector confirms PR:L, meaning the attacker must possess valid LearnHouse credentials (a registered user account). The Image Handler must be accessible via the network interface (AV:N is confirmed). No special configuration, feature flag, or deployment mode is indicated by the CVE description; exploitation succeeds against default LearnHouse deployments where authenticated users exist. The vulnerability is limited to information disclosure with low confidentiality impact; it does not enable modification or deletion of data (VI:N, VA:N) and does not affect system availability (SA:N). |
| Impact | This vulnerability presents low real-world risk despite public exploit availability, supported by converging signals: CVSS 2.1 (very low severity), EPSS 0.03% (10th percentile indicating minimal exploitation probability), and requirement for prior authentication (PR:L). The CVSS vector specifies low confidentiality impact (VC:L) with no integrity or availability impact, confirming information disclosure as the sole concern. Public exploit availability (POC=YES) elevates awareness but has not translated to widespread exploitation given the 10th percentile EPSS ranking, suggesting targeted use or limited attacker interest. The vendor's non-response and rolling-release model complicate patch tracking but do not alter the low objective risk profile. Defenders should prioritize this below network-accessible critical services but address it during routine updates given the low remediation burden and low exploitation probability. |
| Exploit ScenarioDerived | An authenticated user (e.g., student or instructor with a valid LearnHouse account) sends a crafted request to the Image Handler endpoint, exploiting improper access controls to retrieve sensitive image metadata, file paths, or images belonging to other users. The exploit code referenced in the public GitHub gist documents the specific request parameters and response parsing needed to extract this information without authorization. No special user privileges beyond basic authentication are required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 29, 2026
Information disclosure in LearnHouse Image Handler component allows authenticated remote attackers to access sensitive data via the image handling functionality. The vulnerability affects all versions up to commit 98dfad76aad70711a8113f6c1fdabfccf10509ca, with publicly available exploit code documented. Due to LearnHouse's rolling-release model, specific patched version numbers are unavailable, and the vendor has not responded to disclosure attempts.
RemediationAI
No vendor-released patch has been identified at time of analysis due to the vendor's non-response and rolling-release model. Immediate mitigation requires updating LearnHouse to the latest development version on the main branch (post-98dfad76aad70711a8113f6c1fdabfccf10509ca) if available via the project's repository, and monitoring the LearnHouse GitHub repository for security commits addressing Image Handler access control. Interim compensating controls include restricting image handler endpoints to authenticated users only (enforcing existing PR:L requirement), implementing request rate-limiting on image retrieval operations, and reviewing image handler logs for unauthorized access patterns. Additionally, audit which users have been logged in since the vulnerability was introduced, as the information disclosure may have exposed user data or uploaded file metadata. The low CVSS score (2.1) and 10th percentile EPSS suggest this can be addressed during a planned update cycle rather than as an emergency patch.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in LearnHouse's Image Handler component, which processes image uploads and retrieval operations. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating improper access controls or information leakage within the image handling logic. The CVSS vector (PR:L) confirms authenticated access is required, suggesting the Image Handler fails to properly validate permissions or sanitize image metadata/paths when processing requests from logged-in users. LearnHouse uses a rolling-release development model where versioning is commit-based rather than traditional semantic versioning, complicating vulnerability tracking.
Know when Learnhouse gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (vuldb) · only source for this CVE.
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was detected in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. Affected by this issue is some unknown functionality of the component Image Handler. The manipulation results in information disclosure. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
More in Learnhouse
View allLearnHouse allows authenticated remote users to upload arbitrary files via unrestricted manipulation of the thumbnail pa
LearnHouse allows authenticated remote attackers to access unauthorized student assignment files through improper contro
Stored cross-site scripting (XSS) in LearnHouse Account Setting Page allows authenticated users to inject malicious scri
Missing authorization in the LearnHouse assignment API before version 1.1.1 lets an authenticated student read other stu
Exploit-DB