Open edX <2022-06-06 - Cross-Site Scripting

Open edX before 2022-06-06 contains a reflected cross-site scripting vulnerability via the 'next' parameter in the logout URL. id: CVE-2022-32195 info: name: Open edX 2022-06-06 - Cross-Site Scripting author: arafatansari severity: medium description: | Open edX before 2022-06-06 contains a...

CVE-2026-85271

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

CVE-2026-85272

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extractarchive.py uses isbadpath to validate safeextractall targets by comparing resolved path strings with startswith instead of comparing path component...

CVE-2026-85271 Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

CVE-2026-85271

Open edX Platform (versions from Redwood until Ulmo and Verawood.1) contains a stored CSS injection vulnerability in email digest notifications. The add_additional_attributes_to_notifications function in openedx/core/djangoapps/notifications/email/utils.py fails to sanitize discussion-title value...

CVE-2026-85271 Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

EUVD-2026-83443

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

CVE-2026-85271 Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

CVE-2026-85272 Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extractarchive.py uses isbadpath to validate safeextractall targets by comparing resolved path strings with startswith instead of comparing path component...

CVE-2026-85272 Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extractarchive.py uses isbadpath to validate safeextractall targets by comparing resolved path strings with startswith instead of comparing path component...

EUVD-2026-83399

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extractarchive.py uses isbadpath to validate safeextractall targets by comparing resolved path strings with startswith instead of comparing path component...

CVE-2026-85272

CVE-2026-85272 affects Open edX Platform from Aspen.1 through the Ulmo and Verawood.1 releases. The root cause lies in openedx/core/lib/extract_archive.py, where the _is_bad_path function validates extracted archive targets using a string prefix comparison (startswith) instead of comparing indivi...

CVE-2026-85272 Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extractarchive.py uses isbadpath to validate safeextractall targets by comparing resolved path strings with startswith instead of comparing path component...

CVE-2026-85271: Improper Neutralization of Input During Web Page Generation

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

CVE-2026-85272: Improper Limitation of a Pathname to a Restricted Directory

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extractarchive.py uses isbadpath to validate safeextractall targets by comparing resolved path strings with startswith instead of comparing path component...

The vulnerability of the set_course_mode_price() function on the online training platform Open edX allows a violator to gain access to read and modify data.

The vulnerability of the setcoursemodeprice function on the online training platform Open edX is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain access and modify data...

The vulnerability of the validate_timestamp_and_nonce() function in the online training platform Open edX Platform allows attackers to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the validatetimestampandnonce function in the online training platform Open edX Platform relates to bypassing the authentication process. Exploiting this vulnerability could allow a malicious actor to circumvent security restrictions and gain unauthorized access to protected...

CVE-2026-55421

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files.url, performs a server-side fetch using "requests.geturl, allowredirects=True". The fetched bytes are then returned inside a ZIP response. This...

CVE-2026-53635

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function setcoursemodeprice at lms/djangoapps/instructor/views/instructordashboard.py:430 is decorated only with @loginrequired and performs no course-level permission check. An...

CVE-2026-53636

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI Learning Tools Interoperability Provider implementation. The validatetimestampandnonce function in...