EUVD-2026-82559Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach SCORM content endpoint unauthenticated
-
DeliverySubmit traversal path outside public/scorm
-
ExploitSCORMRenderer opens resolved file
-
ExecutionServer streams file contents
-
ImpactRead sensitive server-accessible files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a reachable Frappe LMS instance (prior to 2.52.1) whose SCORM content route handled by SCORMRenderer.render is accessible over the network; per CVSS PR:N/UI:N no authentication or user interaction is needed. Exploitation is LIMITED to files that are readable by the LMS server process - the traversal grants file read only (confidentiality), not write or code execution. Effectiveness depends on the site having SCORM rendering exposed and on which sensitive files (e.g. site_config, source) the server user can access; the target must reach the renderer with a traversal path that resolves outside public/scorm. |
| Impact | Signals are consistent and point to a genuine, straightforward priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:N/VA:N, score 8.7) describes a remote, unauthenticated, low-complexity path traversal with high confidentiality impact and no integrity or availability effect - which matches the description (arbitrary read of files accessible to the server process) and the fix diff exactly. No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit is referenced. However, the vendor-published commit diff (e1b425ed) and PR #2299 reveal both the vulnerable code path and the missing realpath check in detail, effectively lowering the bar to reproduce even without a packaged PoC. The one caveat: impact is bounded to file DISCLOSURE - there is no code execution or write primitive here, so despite the high 8.7 rating the practical blast radius is 'read what the server user can read' (e.g. site config, secrets, source), not full compromise. Treat as a real, patch-now issue for exposed Frappe LMS instances, but not a wormable/RCE-class emergency. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a request to the SCORM content route with a traversal sequence in the path (e.g. ../../ segments) so SCORMRenderer.render resolves and opens a file outside public/scorm. The server streams back the file contents, letting the attacker read sensitive files (site configuration, credentials, application source) that the server process can access. No public exploit is identified, but the fix commit publicly discloses the exact vulnerable code and missing safe-path check. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Unauthenticated path traversal in the SCORMRenderer.render handler of Frappe Learning Management System (LMS) allows a remote attacker to read files outside the intended public/scorm directory on any instance running a version prior to 2.52.1. Because the renderer builds and opens a server-side path from attacker-influenced input without first verifying that the resolved real path stays inside public/scorm, the attacker can retrieve any file the LMS server process can read; per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) the impact is limited to confidentiality - no file write, integrity, or code execution is possible through this flaw. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV entry); the vendor addressed it in version 2.52.1.
RemediationAI
Upgrade Frappe LMS to version 2.52.1 or later, which is the vendor-released patch containing the _is_safe_path realpath-containment check described in GHSA-3mq2-3c8v-m92j (release notes at https://github.com/frappe/lms/releases/tag/v2.52.1); if you track upstream code rather than releases, the corresponding fix is commit e1b425ed5bf0fc9c373efc1ba235c7c70e23d465 from PR 2299. If immediate upgrade is not possible, compensating controls should focus on reducing reachability and blast radius: temporarily disable or block the SCORM rendering route (for example by denying requests that reach SCORMRenderer.render at the reverse proxy or web server) - this removes the exposure but breaks SCORM content playback for legitimate learners; normalize and reject request paths containing traversal sequences (../ or encoded equivalents) at the reverse proxy before they reach the application, accepting that bypass via unusual encodings is possible and that this is not a substitute for the patch; and run the Frappe/LMS worker and web processes under a least-privilege OS account with no read access to sensitive files such as site_config.json, database credentials, environment files, or SSH keys, which limits what a successful traversal can disclose but does not eliminate the flaw. Verify after remediation that SCORM content still loads correctly and review server logs for prior traversal attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Frappe LMS is a Frappe Framework-based learning management application written in Python, and the affected code lives in lms/page_renderers.py. The SCORMRenderer class serves SCORM e-learning content from the site's public/scorm directory; SCORM is a legacy package format whose manifests reference chapter folders and index files that the renderer resolves dynamically. The vulnerable implementation joined the request-derived path onto the site path and called open() directly, without canonicalizing the result with os.path.realpath and confirming containment in the SCORM root. This is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e., Path Traversal): because no canonicalization step preceded the filesystem access, sequences such as ../ escaped the SCORM sandbox. The upstream fix (commit e1b425ed5bf0fc9c373efc1ba235c7c70e23d465, PR 2299) introduces an _is_safe_path helper that resolves both the SCORM root and the requested path via os.path.realpath and returns True only when the resolved path equals or is a strict child of the SCORM root, raising frappe.PermissionError otherwise; the file-serving logic is also consolidated into a _serve_file helper that is called only after the containment check passes. The check depends on the LMS instance actually exposing SCORM content rendering, and successful reads are bounded by the privileges of the user account under which the Frappe server process runs.
Know when Frappe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Remote unauthenticated traversal with no interaction (AV:N/AC:L/PR:N/UI:N); arbitrary file read gives C:H, but there is no write or DoS primitive so I:N/A:N.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, a remote attacker can request a traversal path handled by SCORMRenderer.render in lms/page_renderers.py. The renderer constructs and opens a server-side path without first confirming that its real path remains within public/scorm, allowing files outside the SCORM directory to be read when they are accessible to the server process. This issue is fixed in version 2.52.1.
Technical POC Analysis
Evidence basis: GHSA-3mq2-3c8v-m92j (frappe/lms) plus the CVE brief.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Frappe Learning Management System deployments running versions earlier than 2.52.1 are exposed to an unauthenticated path traversal flaw (CVE-2026-54343) that allows any remote party to read files the LMS server process can access, including configuration files, integration secrets, and learner records. Because no credentials or user interaction are required, every internet-facing instance is effectively reachable by anyone with network access, and the flaw can be triggered with commodity tooling rather than specialized exploit code. Leadership should treat this as a confidentiality and data-exposure risk to student information and connected systems rather than an availability issue, and prioritize version upgrade alongside an assessment of what may already have been read.
Apply vendor patch (upgrade to 2.52.1).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
Authenticated SQL injection in Frappe ERPNext through 15.89.0 allows low-privilege users to extract arbitrary database c
SQL injection in Frappe ERPNext through 15.89.0 lets an authenticated attacker with a valid session and access to the Pa
Authenticated server-side template injection in Frappe ERPNext through 15.89.0 lets a user who can create or modify an A
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. Rated high sev
Arbitrary file read in the Frappe full-stack web application framework allows remote unauthenticated attackers to retrie
SQL injection in Frappe HelpDesk 1.14.0 dashboard functionality allows authenticated attackers to execute arbitrary SQL
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/re
Exploit-DB