CVE-2026-39405CWE-22
Frappe has Path Transversal via SCORM
Critical · published May 20, 2026
What it is
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.50.0 and below, a user with course editing role could upload a SCORM ZIP package to write files outside the intended directory. This issue has been resolved in version 2.50.1.
The record
Technical detail
- CVSS v4.0
- 9.4 · CRITICAL
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- EPSS
- 0.00454 · 38.4th percentile
- Weakness
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Published
- 2026-05-20T19:34Z
EPSS history
Timeline