Stored XSS Vulnerability in Frappe Learning Management System by Frappe
CVE-2026-23497

1.3LOW

Key Information:

Vendor

Frappe

Status
Lms
Vendor
CVE Published:
14 January 2026

What is CVE-2026-23497?

The Frappe Learning Management System, a platform designed for structuring educational content, is affected by a stored XSS vulnerability in versions 2.44.0 and earlier. This flaw allows attackers to craft malicious image filenames that, when rendered in course or job pages, can execute arbitrary JavaScript. This may enable unauthorized actions or data exposure, underscoring the need for immediate attention to security measures in deployed instances.

Affected Version(s)

lms <= 2.44.0

References

https://github.com/frappe/lms/security/advisories/GHSA-78...
x_refsource_CONFIRM
https://github.com/frappe/lms/commit/e7ccf0a711d0e0ab5e6b...
x_refsource_MISC

CVSS V4

Score:
1.3
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.