CVE-2026-85272 Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation

🗓️ 18 Sep 2026 20:27:44Reported by GitHub_MType

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extract_archive.py uses _is_bad_path to validate safe_extractall targets by comparing resolved path stri...

Reporter	Title	Published	Views	Family All 4
Circl	CVE-2026-85272	18 Sep 202622:57	–	circl
CVE	CVE-2026-85272	18 Sep 202620:27	–	cve
EUVD	EUVD-2026-83399	18 Sep 202620:27	–	euvd
NVD	CVE-2026-85272	18 Sep 202621:18	–	nvd

[
  {
    "vendor": "openedx",
    "product": "openedx-platform",
    "versions": [
      {
        "version": ">= release/aspen.1, < release/ulmo.4",
        "status": "affected"
      },
      {
        "version": ">= release/aspen.1, < release/verawood.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/openedx/openedx-platform/releases/tag/release/verawood.1
github	www.github.com/openedx/openedx-platform/commit/8422334e2063015a28b6460a34aa4bb4d8ae1ca8
github	www.github.com/openedx/openedx-platform/security/advisories/GHSA-6cmm-8875-5pcw
github	www.github.com/openedx/openedx-platform/commit/97de0586d878936c9f97c03fdaa20346ee8eac29
github	www.github.com/openedx/openedx-platform/commit/e552907ff33a7b2e53f99b819123c9dacdfc127a
github	www.github.com/openedx/openedx-platform/releases/tag/release/ulmo.4

18 Sep 2026 20:27Current

CVSS 3.14.3

EPSS0.00332

CWE-22