CVE-2026-54343 Frappe LMS: Path Traversal in SCORM File Serving
A remote attacker can read arbitrary files outside the SCORM directory via path traversal in Frappe LMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54343?
CVE-2026-54343 is a high-severity path traversal vulnerability in frappe lms, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, a remote attacker can request a traversal path handled by SCORMRenderer.render in lms/page_renderers.py. The renderer constructs and opens a server-side path without first confirming that its real path remains within public/scorm, allowing files outside the SCORM directory to be read when they are accessible to the server process. This issue is fixed in version 2.52.1.
Weakness: CWE-22
Which versions are affected by CVE-2026-54343?
How do I fix CVE-2026-54343?
No fix has been published for CVE-2026-54343 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-54343 being exploited?
There is no known exploitation of CVE-2026-54343 in the wild and no public exploit code.
Sources
Also known as GHSA-3mq2-3c8v-m92j.