Frappe LMS SCORM Path Traversal Vulnerability Patched

A recent disclosure of a severe vulnerability affecting the Frappe Learning Management System (LMS). Tracked under the GitHub Security Advisory identifier GHSA-mxh7-g3r7-g96h and officially designated as CVE-2026-39405, this flaw exposes systems to arbitrary file writes via a path traversal weakness in the platform’s SCORM module.

Discovered by security researcher Nick Hefty (@nickhefty) and recently published by maintainer raizasafeel, this critical vulnerability underscores the persistent risks associated with unrestricted archive extraction in web applications.

With affected versions spanning up to 2.49.0, administrators must apply the patch introduced in version 2.50.1 immediately to prevent system compromise.

In an era where digital education infrastructure is as critical as physical infrastructure, a successful compromise of an LMS can lead to severe reputational damage and significant regulatory penalties under frameworks like GDPR or FERPA.

Frappe SCORM Path Traversal Vulnerability

Frappe LMS is a widely deployed, open-source learning system designed to help educators seamlessly structure and deliver educational content. Like many modern e-learning ecosystems, it relies heavily on standardized frameworks to import and export courses.

At the heart of this specific vulnerability is the platform’s handling of Shareable Content Object Reference Model (SCORM) packages. SCORM is the de facto industry standard for e-learning interoperability, and its courses are distributed as compressed ZIP archives containing HTML, XML, multimedia, and JavaScript files.

When a user uploads a SCORM package, the LMS backend automatically extracts these files into a designated directory on the server to serve the educational content to students. However, in Frappe LMS versions 2.49.0 and earlier, this extraction routine lacked rigorous path validation, setting the perfect stage for a path traversal attack.

A path traversal vulnerability (formally classified as CWE-22: Improper Limitation of a Pathname to a Restricted Directory) occurs when an application fails to adequately sanitize user-supplied input that dictates file system paths. In the context of archive extraction, this vector is notoriously known within the cybersecurity community as a “Zip Slip” attack.

ZIP archives do not merely store file data; they also store the hierarchical directory structure and file names as strings. A malicious actor can craft a customized ZIP file where the embedded file names contain directory traversal sequences specifically, the “dot-dot-slash” (../) notation.

When a vulnerable application extracts such an archive, it blindly resolves these relative path sequences. Instead of confining the extracted files to the designated SCORM staging folder, the operating system walks back up the directory tree, allowing the attacker to deposit files anywhere on the file system where the web server process has active write permissions.

Exploiting GHSA-mxh7-g3r7-g96h is not entirely unauthenticated, but the barrier to entry is alarmingly low for insider threats or compromised accounts. The primary prerequisite is that the attacker must possess a “course editing role” within the Frappe LMS environment. This role is commonly granted to instructors, teaching assistants, or content creators.

Once an attacker acquires these privileges whether through legitimate assignment, credential stuffing, or phishing they can seamlessly initiate the attack chain. The attacker crafts a malicious SCORM ZIP package containing a malicious payload, such as a PHP web shell, paired with a traversal path like ../../../var/www/html/shell.php.

Upon uploading this package via the standard course creation interface, the backend extraction process blindly writes the payload to the attacker’s desired location. This oversight effectively turns a routine administrative task into a devastating security breach.

The security ramifications of this path traversal vulnerability are extensive, earning it a Critical severity rating under the CVSS framework. The most immediate and severe consequence is Remote Code Execution (RCE).

By overwriting executable server files or planting web shells in publicly accessible web directories, an attacker can transition from an application-level user to executing arbitrary commands on the underlying host operating system.

This level of access enables comprehensive system takeover. Attackers can exfiltrate sensitive databases containing student records, proprietary course materials, and intellectual property.

Furthermore, they can modify existing system files to establish persistent backdoors, deploy ransomware, or use the compromised server as a pivot point to launch lateral attacks against other segments of the organization’s internal network.

Remediation

The maintainers of Frappe LMS responded swiftly to the disclosure by Nick Hefty, issuing a comprehensive patch in version 2.50.1. The remediation focuses directly on the root cause: the lack of extraction path sanitization.

In the patched versions, the source code has been updated to rigorously validate all file paths during the SCORM ZIP extraction process. The backend now computes the absolute path of the target extraction directory and compares it against the resolved absolute paths of the files contained within the ZIP archive.

If any file attempts to write outside the strict boundaries of the intended SCORM directory, the extraction process is immediately halted or the malicious file is safely skipped.

This fundamental validation ensures that even if an attacker successfully uploads a manipulated ZIP file, the traversal sequences are neutralized before they interact with the host file system.

While upgrading to Frappe LMS 2.50.1 mitigates this specific path traversal flaw, the disclosure serves as a critical reminder of the broader security hygiene required to maintain e-learning infrastructure. Administrators must adopt a defense-in-depth strategy:

Principle of Least Privilege: Course editing roles should be strictly audited and granted only to highly trusted personnel.
Restrict Write Permissions: Deploy web server configurations where the application process only has write access to specific, non-executable upload directories. This ensures that even if a malicious payload is successfully written to the disk, the web server cannot execute it as a script.
Infrastructure Isolation: Consider implementing containerization with read-only root file systems to drastically limit the blast radius of any successful arbitrary file write attack.