CVE-2026-54343High· 8.7▾ TwilightFrappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, a remote attacker can request a traversal path handled by SCORMRenderer.render in lms/page_renderers.py. The …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
Last analysed / modified upstream
0.5% → 0.7%
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, a remote attacker can request a traversal path handled by SCORMRenderer.render in lms/page_renderers.py. The renderer constructs and opens a server-side path without first confirming that its real path remains within public/scorm, allowing files outside the SCORM directory to be read when they are accessible to the server process. This issue is fixed in version 2.52.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112031Low· 3.5Chamilo LMS Ticket TicketManager.php addProject cross site scripting
CVE-2026-78532High· 7.1Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.
CVE-2026-96777Medium· 6.3A vulnerability was determined in Forma LMS up to 4.1.43
CVE-2026-116492Medium· 6.5Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API
CVE-2026-115717High· 7.7Frappe Builder before 1.36.1 SSRF via convert_to_webp
CVE-2026-115718Medium· 4.3Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt