CVE-2026-54343— Frappe LMS: Path Traversal in SCORM File Serving
Quick assessment
Affected
frappe lms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Frappe 学习管理系统（LMS）是一个帮助用户组织课程内容的学习系统。在 2.52.1 版本之前，远程攻击者可以请求由 中 函数处理的路径遍历路径。该渲染器在构建并打开服务器端路径时，未首先验证其真实路径是否仍位于 目录之内，导致当服务器进程可访问某些文件时，攻击者能够读取 SCORM 目录之外的文件。此问题已在 2.52.1 版本中修复。
Possible ATT&CK Techniques 1 AI
T1083 · File and Directory Discovery
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54343
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Frappe LMS: Path Traversal in SCORM File Serving
Source: CVE Program / CVE List V5
Vulnerability Description
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, a remote attacker can request a traversal path handled by SCORMRenderer.render in lms/page_renderers.py. The renderer constructs and opens a server-side path without first confirming that its real path remains within public/scorm, allowing files outside the SCORM directory to be read when they are accessible to the server process. This issue is fixed in version 2.52.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-54343
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54343
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-54343 (2)
Vendor Advisories for CVE-2026-54343 (1)
-
🔗 Path Traversal in SCORM File Serving · Advisory · frappe/lms · GitHub x_refsource_CONFIRM
Vendor Pages for CVE-2026-54343 (1)
-
🔗 Release v2.52.1 · frappe/lms · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same vendor: frappe
-
CVE-2026-54524
Frappe HR: SQL Injection in HRMS Salary Payments Based on Pa -
CVE-2023-51769
Frappe 跨站脚本漏洞 -
CVE-2026-53761
Frappe CRM: Authentication Bypass via Logged Invitation Keys -
CVE-2026-82634
Frappe Framework Development Branch Incorrect Authorization -
CVE-2026-81731
Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link
Same weakness: CWE-22
-
CVE-2026-54612
Vvveb: Authenticated editor path traversal to PHP file write -
CVE-2026-54613
Vvveb: Path Traversal in Revision Backup Reader/Deleter via -
CVE-2026-53554
SQLBot: Arbitrary File Write via parseExcel Leading to Code -
CVE-2026-45140
Chamilo LMS CStudio upload flow allows unauthenticated remot -
CVE-2026-54617
GravitLauncher: Unauthenticated path traversal in LaunchServ
V. Comments for CVE-2026-54343
No comments yet