CVE-2026-85271

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

CVE-2026-85272

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extractarchive.py uses isbadpath to validate safeextractall targets by comparing resolved path strings with startswith instead of comparing path component...

CVE-2026-85271 Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

CVE-2026-85271 Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

CVE-2026-85271 Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

CVE-2026-85272 Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extractarchive.py uses isbadpath to validate safeextractall targets by comparing resolved path strings with startswith instead of comparing path component...

CVE-2026-85272 Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extractarchive.py uses isbadpath to validate safeextractall targets by comparing resolved path strings with startswith instead of comparing path component...

EUVD-2026-83399

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extractarchive.py uses isbadpath to validate safeextractall targets by comparing resolved path strings with startswith instead of comparing path component...

CVE-2026-85272 Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extractarchive.py uses isbadpath to validate safeextractall targets by comparing resolved path strings with startswith instead of comparing path component...

CVE-2026-85272

CVE-2026-85272 affects Open edX Platform from Aspen.1 through the Ulmo and Verawood.1 releases. The root cause lies in openedx/core/lib/extract_archive.py, where the _is_bad_path function validates extracted archive targets using a string prefix comparison (startswith) instead of comparing indivi...

CVE-2026-85272: Improper Limitation of a Pathname to a Restricted Directory

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extractarchive.py uses isbadpath to validate safeextractall targets by comparing resolved path strings with startswith instead of comparing path component...

CVE-2026-85271: Improper Neutralization of Input During Web Page Generation

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

The vulnerability of the validate_timestamp_and_nonce() function in the online training platform Open edX Platform allows attackers to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the validatetimestampandnonce function in the online training platform Open edX Platform relates to bypassing the authentication process. Exploiting this vulnerability could allow a malicious actor to circumvent security restrictions and gain unauthorized access to protected...

CVE-2026-53635

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function setcoursemodeprice at lms/djangoapps/instructor/views/instructordashboard.py:430 is decorated only with @loginrequired and performs no course-level permission check. An...

CVE-2026-55421

Open edX Platform is vulnerable to SSRF with response exfiltration in the Studio Video Download Endpoint. Prior to commit 00b7c3c, the endpoint accepts a user-supplied files[].url and performs a server-side fetch via requests.get(url, allow_redirects=True), returning the fetched bytes inside a ZI...

CVE-2026-55421 Open edX Platform: SSRF in Studio Video Download Endpoint

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files.url, performs a server-side fetch using "requests.geturl, allowredirects=True". The fetched bytes are then returned inside a ZIP response. This...

CVE-2026-55421 Open edX Platform: SSRF in Studio Video Download Endpoint

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files.url, performs a server-side fetch using "requests.geturl, allowredirects=True". The fetched bytes are then returned inside a ZIP response. This...

CVE-2026-53635

Open edX Platform is affected by an insufficient permission check in the set_course_mode_price() view at lms/djangoapps/instructor/views/instructor_dashboard.py:430. The endpoint is protected only by @login_required and performs no course-level authorization, meaning any authenticated user —inclu...

CVE-2026-53635 Open edX Platform: Insufficient Permission on set_course_mode_price()

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function setcoursemodeprice at lms/djangoapps/instructor/views/instructordashboard.py:430 is decorated only with @loginrequired and performs no course-level permission check. An...

CVE-2026-53636: Authentication Bypass by Capture-replay

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI Learning Tools Interoperability Provider implementation. The validatetimestampandnonce function in...