CVE-2026-39405
Critical · CVSS 9.4- CVSS
- 9.4
- nvd
- EPSS
- 0.30%
- 23th pct
- KEV
- No
- Class
- oss containerizable
- CWE-22
Description
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.50.0 and below, a user with course editing role could upload a SCORM ZIP package to write files outside the intended directory. This issue has been resolved in version 2.50.1.
References
Status: profiled · ingested 2026-07-23T18:00:18.000Z