CVE-2025-47942: Learners on edX Platform can download python_lib.zip
The Open edX Platform is a learning management platform. Prior to commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, edxapp has no built-in protection against downloading the pythonlib.zip asset from courses, which is a concern since it often contains custom grading code or answers to course problems. This potentially affects any course using custom Python-graded problem blocks. The openedx/configuration repo has had a patch since 2016 in the form of an nginx rule, but this was only intended as a temporary mitigation. As the configuration repo has been deprecated and we have not been able to locate any similar protection in Tutor, it is likely that most deployments have no protection against pythonlib.zip being downloaded. The recommended mitigation, implemented in commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, restricts pythonlib.zip downloads to just the course team and site staff/superusers.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47942?
The severity of CVE-2025-47942 is considered to be medium due to the potential exposure of sensitive course materials.
How do I fix CVE-2025-47942?
To fix CVE-2025-47942, upgrade edxapp to the commit version 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba or later.
What does CVE-2025-47942 affect?
CVE-2025-47942 affects the Open edX platform, specifically the edxapp component prior to the specified commit.
What are the risks associated with CVE-2025-47942?
CVE-2025-47942 poses risks of unauthorized downloading of the python_lib.zip, which may contain sensitive grading code or answers.
Is there a known exploit for CVE-2025-47942?
As of now, there are no reported exploits for CVE-2025-47942, but the vulnerability should still be addressed promptly.