Path Traversal in Frappe Lms

CVE-2026-39405

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.50.0 and below, a user with course editing role could upload a SCORM ZIP package to write files outside the intended direc…

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.001 (16.7th percentile) — read the EPSS interpretation.