CVE-2026-54343 - Frappe LMS: Path Traversal in SCORM File Serving

Back Back to CVE browser

HIGH

Frappe LMS: Path Traversal in SCORM File Serving

Published Sep 17, 2026

8.7

HIGH

CVSS 4.0

EPSS 0.68%

Description

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, a remote attacker can request a traversal path handled by SCORMRenderer.render in lms/page_renderers.py. The renderer constructs and opens a server-side path without first confirming that its real path remains within public/scorm, allowing files outside the SCORM directory to be read when they are accessible to the server process. This issue is fixed in version 2.52.1.

Affected products

Vendor Frappe Product Lms Default
n/a
- Version
  < 2.52.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Frappe

Lms

n/a

Version	Status	Constraints
< 2.52.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (4)

https://github.com/frappe/lms/commit/e1b425ed5bf0fc9c373efc1ba235c7c70e23d465
x_refsource_MISC
https://github.com/frappe/lms/pull/2299
x_refsource_MISC
https://github.com/frappe/lms/releases/tag/v2.52.1
x_refsource_MISC
https://github.com/frappe/lms/security/advisories/GHSA-3mq2-3c8v-m92j
x_refsource_CONFIRM

Link	Providers	Tags
https://github.com/frappe/lms/commit/e1b425ed5bf0fc9c373efc1ba235c7c70e23d465		x_refsource_MISC
https://github.com/frappe/lms/pull/2299		x_refsource_MISC
https://github.com/frappe/lms/releases/tag/v2.52.1		x_refsource_MISC
https://github.com/frappe/lms/security/advisories/GHSA-3mq2-3c8v-m92j		x_refsource_CONFIRM