Skip to content
CVE PROGRAM SOURCE RECORD9.4 Critical

CVE-2026-39405

Frappe has Path Transversal via SCORM

Description

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.50.0 and below, a user with course editing role could upload a SCORM ZIP package to write files outside the intended directory. This issue has been resolved in version 2.50.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

frappe lms

  • < 2.50.1affected

References