CVE-2025-55006: fallo de gravedad media en frappe lms
Frappe Learning Holds Potential for Malicious SVG Upload in Image Upload Feature
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.3epss 0.3%
Frappe Learning is a learning system that helps users structure their content. In versions 2.33.0 and below, the image upload functionality did not adequately sanitize uploaded SVG files. This allowed users to upload SVG files containing embedded JavaScript or other potentially malicious content. Malicious SVG files could be used to execute arbitrary scripts in the context of other users. A fix for this issue is planned for version 2.34.0.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Productos afectados
frappe · lmsCVEs relacionadas — frappe lms
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-54343HIGHFrappe LMS: Path Traversal in SCORM File ServingEPSS 0.7%CVE-2023-42807MEDIUMFrappe LMS SQL Injection Issue on People PageEPSS 0.4%CVE-2026-39385HIGHFrappe LMS enrollment bypass in paid courses via unrelated batchEPSS 0.4%CVE-2026-39375MEDIUMFrappe LMS has Stored XSS in Course MetaEPSS 0.3%CVE-2026-26977MEDIUMFrappe Learning Management System exposes details of unpublished courses to unauthorized usersEPSS 0.3%CVE-2026-39405CRITICALFrappe has Path Transversal via SCORMEPSS 0.3%