CVE-2026-39375— Frappe LMS has Stored XSS in Course Meta

Quick assessment

Affected

frappe lms

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Frappe 学习管理系统（LMS）是一个帮助用户组织内容的学习平台。在 2.52.0 版本之前，拥有课程编辑角色的已认证用户可以在“课程管理”模块中，通过元标签（meta tag）字段注入恶意的 JavaScript 代码。由于这些值在存储时未进行充分的 HTML 清理，且在渲染时未进行安全的转义处理，导致存在存储型跨站脚本（Stored XSS）漏洞。该问题已在 2.52.0 版本中修复。

CVSS 5.1 · Medium Updated Oct 31, 2026

Possible ATT&CK Techniques 1 AI

T1193

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Frappe LMS has Stored XSS in Course Meta

Source: CVE Program / CVE List V5

Vulnerability Description

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting. This issue is fixed in version 2.52.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
frappe	lms	< 2.52.0	-

II. Public POCs for CVE-2026-39375

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-39375

请登录查看更多情报信息。

Other References for CVE-2026-39375 (4)

https://github.com/frappe/lms/tree/v2.52.0 x_refsource_MISC
https://github.com/frappe/lms/security/advisories/GHSA-9fqj-95wr-6hm6 x_refsource_CONFIRM
https://github.com/frappe/lms/commit/f244a6c9ff6e0b104fec48b2d97af4cc09896b60 x_refsource_MISC
https://github.com/frappe/lms/commit/cd6aca25f7d28425660720db4fdb920727edb670 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-39375

Same Patch Batch · frappe · 2026-10-30 · 4 CVEs total

CVE-2026-61803	5.3 MEDIUM	Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbit
CVE-2026-61805	5.3 MEDIUM	Frappe LMS: Quiz result manipulation and cross-user submission forgery
CVE-2026-61806	5.3 MEDIUM	Frappe LMS allows unpublished certificate access

IV. Related Vulnerabilities

Same product: lms

Same vendor: frappe

Same weakness: CWE-79