CVE-2025-62158: Frappe had attachments made by students to their assignments of type Text set to public
Frappe Learning is a learning system that helps users structure their content. In versions prior to 2.38.0, the system did stored the attachments uploaded by the students in their assignments as public files. This issue potentially exposed student-uploaded files to the public. Anyone with the file URL could access these files without authentication. The issue has been fixed in version 2.38.0 by ensuring all student-uploaded assignment attachments are stored as private files by default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe Learningto a version that resolves this vulnerability.Fixed in 2.38.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62158?
CVE-2025-62158 is considered a high severity vulnerability due to the potential exposure of sensitive student-uploaded files.
How do I fix CVE-2025-62158?
To fix CVE-2025-62158, upgrade Frappe Learning to version 2.38.0 or later.
What versions are affected by CVE-2025-62158?
CVE-2025-62158 affects all versions of Frappe Learning prior to 2.38.0.
What type of vulnerability is CVE-2025-62158?
CVE-2025-62158 is a stored file exposure vulnerability.
Who is impacted by CVE-2025-62158?
Students using Frappe Learning versions before 2.38.0 are at risk of having their uploaded assignments exposed.