CVE-2026-54343: Frappe LMS: Path Traversal in SCORM File Serving
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, a remote attacker can request a traversal path handled by SCORMRenderer.render in lms/pagerenderers.py. The renderer constructs and opens a server-side path without first confirming that its real path remains within public/scorm, allowing files outside the SCORM directory to be read when they are accessible to the server process. This issue is fixed in version 2.52.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe Learning Management System (LMS)to a version that resolves this vulnerability.Fixed in 2.52.1
Event History
Frequently Asked Questions
Which deployments are affected?
Frappe LMS versions before 2.52.1 are affected. The issue is reachable remotely through requests handled by the SCORM renderer.
What can an attacker access if exploitation succeeds?
An attacker may read files outside the public/scorm directory, but only when those files are accessible to the server process running LMS.
What should teams do to remediate this issue?
Upgrade Frappe LMS to version 2.52.1, which fixes the path validation issue.