CVE-2026-54343 Frappe LMS: Path Traversal in SCORM File Serving

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.1, a remote attacker can request a traversal path handled by SCORMRenderer.render in lms/pagerenderers.py. The renderer constructs and opens a server-side path without first...

EUVD-2026-82559

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.1, a remote attacker can request a traversal path handled by SCORMRenderer.render in lms/pagerenderers.py. The renderer constructs and opens a server-side path without first...

CVE-2026-54343

Frappe LMS versions prior to 2.52.1 are affected by a path traversal vulnerability in the SCORMRenderer.render function within lms/page_renderers.py. The renderer constructs and opens a server-side file path without verifying that the resolved path remains within the public/scorm directory, allow...

CVE-2026-54343 Frappe LMS: Path Traversal in SCORM File Serving

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.1, a remote attacker can request a traversal path handled by SCORMRenderer.render in lms/pagerenderers.py. The renderer constructs and opens a server-side path without first...

CVE-2026-54343 Frappe LMS: Path Traversal in SCORM File Serving

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.1, a remote attacker can request a traversal path handled by SCORMRenderer.render in lms/pagerenderers.py. The renderer constructs and opens a server-side path without first...

CVE-2026-54343: Improper Limitation of a Pathname to a Restricted Directory

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.1, a remote attacker can request a traversal path handled by SCORMRenderer.render in lms/pagerenderers.py. The renderer constructs and opens a server-side path without first...

PT-2026-95140

Name of the Vulnerable Software and Affected Versions Frappe Learning Management System LMS versions prior to 2.52.1 Description A remote attacker can request a traversal path handled by the SCORMRenderer.render function in lms/page renderers.py. The renderer constructs and opens a server-side pa...