Frappe LMS CVE-2026-39405

Requires an authenticated account with the course-editing role on a Frappe LMS instance running version 2.50.0 or earlier, and the ability to reach the SCORM ZIP upload feature within the course-builder workflow - the vulnerability is specifically in handling of SCORM package archives, not arbitrary file uploads. No user interaction by a victim is needed (UI:N) and no additional preconditions such as MFA bypass or non-default configuration are described. Exploitation is limited by the PR:L authentication gate (course-editor role, not anonymous), so deployments that tightly scope the editor role to vetted instructors materially reduce exposure; conversely, instances with self-service instructor signup or broadly granted editor roles are effectively pre-authenticated from an attacker's perspective.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation requiring low-privileged authentication and no user interaction, with high VC/VI/VA and high SC/SI/SA - meaning compromise of the LMS process can propagate to subsequent components on the host. The PR:L requirement is meaningful: an attacker needs a valid account with course-editing role, which limits opportunistic mass-exploitation but does not protect environments that grant editor roles liberally (e.g., shared instructor accounts, weak onboarding controls, or insider threats). No EPSS score, KEV listing, or public POC was provided in the input, so realistic risk is high in terms of impact but currently bounded by the authentication gate; no public exploit identified at time of analysis. The headline 9.4 should not be mistaken for unauthenticated RCE - it reflects the post-auth blast radius, not ease of initial access.

An attacker with a compromised or legitimate course-editor account crafts a SCORM ZIP whose entries contain traversal sequences (e.g., ../../apps/lms/site_config.json or paths into the Frappe sites directory) and uploads it through the LMS course-builder UI. On extraction, the server writes attacker-controlled files to sensitive locations, enabling overwrite of configuration, planting of executable hooks, or staging of follow-on code execution; no public POC is identified at time of analysis but the bug class is well-known and trivially weaponized.