CVE-2025-62158CWE-200information-disclosure

CVE-2025-62158

Medium · published October 11, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
19.9
In the wild
Unconfirmed
What it is

Frappe Learning is a learning system that helps users structure their content. In versions prior to 2.38.0, the system did stored the attachments uploaded by the students in their assignments as public files. This issue potentially exposed student-uploaded files to the public. Anyone with the file URL could access these files without authentication. The issue has been fixed in version 2.38.0 by ensuring all student-uploaded assignment attachments are stored as private files by default.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00285 · 19.9th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-10-11T00:15Z
Affected products (1)
ProductVersionsFixed in
frappe/learningall versions—
References (2)
https://github.com/frappe/lms/commit/78640561f558a6c7396f8be48874f79a54f03420 · [email protected]https://github.com/frappe/lms/security/advisories/GHSA-h6fh-7f24-f2j5 · [email protected]
EPSS history
Timeline
  • 10 OCT 20:05Z
    Frappe had attachments made by students to their assignments of type Text set to public
    cvelistv5