CVE-2025-55006: Frappe Learning Holds Potential for Malicious SVG Upload in Image Upload Feature
Frappe Learning is a learning system that helps users structure their content. In versions 2.33.0 and below, the image upload functionality did not adequately sanitize uploaded SVG files. This allowed users to upload SVG files containing embedded JavaScript or other potentially malicious content. Malicious SVG files could be used to execute arbitrary scripts in the context of other users. A fix for this issue is planned for version 2.34.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55006?
CVE-2025-55006 has a medium severity rating due to the risk of malicious SVG file uploads.
How do I fix CVE-2025-55006?
To fix CVE-2025-55006, upgrade Frappe Learning to version 2.34.0 or higher where the vulnerability is addressed.
What versions of Frappe Learning are affected by CVE-2025-55006?
Frappe Learning versions 2.33.0 and below are affected by CVE-2025-55006.
What type of files can cause vulnerabilities in CVE-2025-55006?
CVE-2025-55006 allows the upload of SVG files containing potentially malicious embedded JavaScript.
Is user data at risk due to CVE-2025-55006?
Yes, malicious SVG file uploads in CVE-2025-55006 can lead to security breaches that compromise user data.