Path Traversal Vulnerability in Frappe Learning Management System

CVE-2026-54343

What is CVE-2026-54343?

The Frappe Learning Management System contains a path traversal vulnerability that allows remote attackers to access files outside the intended SCORM directory. This issue arises from the SCORMRenderer.render function in lms/page_renderers.py, which improperly constructs and opens server-side paths without validating their location. As a result, sensitive files accessible to the server process may be revealed. This vulnerability has been addressed in version 2.52.1, where enhanced checks have been implemented to ensure file paths remain within the authorized directory.

References