Frappe Learning CVE-2025-62158

Exploitation requires a Frappe Learning instance prior to 2.38.0 where students have uploaded assignment attachments; because the default upload path stored these as public files, no authentication or special configuration is needed to retrieve them. The concrete limiting factor is that an attacker must possess or discover the specific file URL - the fix (adding private: true to the assignment upload args in Assignment.vue) makes clear the exposure is via the public-file mechanism, so practical risk hinges on URL leakage (shared links, referrer headers, logs) or URL predictability rather than open file listing. Impact is confined to confidentiality of student-uploaded assignment content; no write or availability impact exists.

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes unauthenticated network reachability, but the only impact metric set is VC:L (low confidentiality) with VI/VA:N, yielding a base score of just 2.7 - the vulnerability leaks data but cannot modify or deny anything. EPSS reinforces low urgency at 0.29% (19th percentile), and the CVSS 4.0 exploit-maturity metric is E:U (unreported/unproven). There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not under active exploitation. The one nuance worth flagging: PR:N plus the description's 'anyone with the file URL could access these files without authentication' means the true barrier is not authentication but knowledge of the (typically non-enumerable) file URL - so real-world exposure depends on URL leakage (shared links, referrer headers, logs, enumeration) rather than open directory browsing. Net assessment: a real but minor information-disclosure bug affecting student privacy, not an infrastructure-compromise priority; patch on a normal maintenance cycle.

A student uploads an assignment attachment (e.g., containing personal or academic information) to a Frappe Learning instance running a version prior to 2.38.0, where it is stored as a public file. An attacker who obtains or guesses the file's URL - through a shared link, browser history, referrer leakage, or log exposure - retrieves the attachment over the network without any authentication. No public exploit code is required; access is a simple unauthenticated HTTP GET to the file URL.