Path Traversal in Frappe Lms

CVE-2026-39405

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.50.0 and below, a user with course editing role could upload a SCORM ZIP package to write files outside the intended direc…

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.003 (22.3th percentile) — read the EPSS interpretation.