Frappe Learning Management System

CVE-2026-39405 is a ZIP-slip style path traversal in Frappe LMS SCORM package handling. In Frappe LMS 2.50.0 and below, a user who already has the course editing role can upload a crafted SCORM ZIP whose file names contain traversal sequences, causing extraction outside the intended public/scorm/... directory; the fix landed in 2.50.1.

In a vacuum, arbitrary file write by a web app is scary enough to tempt a CRITICAL label. In real enterprise conditions, the biggest truth is the friction: this is not unauthenticated internet RCE; it requires a valid account, the right role, and use of a specific LMS feature. That pushes it down to = ASSESSED AT HIGH even though the downstream impact can still become code execution or full site compromise on badly isolated deployments.

Why this verdict

• Authenticated and role-bound: exploitation requires a valid account with the course editing role, which implies insider abuse or a prior compromise stage; that is the main reason this is not CRITICAL.
• Feature-gated exposure: only deployments that actually use SCORM imports and delegate content-authoring rights to semi-trusted users are meaningfully exposed, which narrows the reachable population well below generic web-app exposure.
• Impact remains heavyweight: once reached, this is arbitrary file write by the application process, which can absolutely lead to high-consequence outcomes on weakly isolated hosts.

Why not higher?

This is not an unauthenticated edge exploit and not a wormable path. The attacker must already be inside the trust boundary with the right role, and that prerequisite should be stopped by MFA, SSO hygiene, PAM discipline, and least-privilege role assignment in many enterprises.

Why not lower?

Arbitrary file write is not a cosmetic bug. Even with the prerequisite friction, a compromised editor account on a vulnerable host can still tamper with served content, plant persistence, or escalate to code execution depending on filesystem layout and restart behavior.

1. Restrict or disable SCORM uploads — If SCORM import is unused, turn it off; if it is needed, limit it to a tiny trusted author group. This directly removes the vulnerable code path and should be deployed within 30 days for a HIGH finding.
2. Shrink course-editor privileges — Audit who actually has course editing rights and remove the role from broad instructor or contractor populations. Because this bug is role-gated, privilege cleanup is a first-order risk reducer and should be completed within 30 days.
3. Harden filesystem boundaries — Run the Frappe process with least privilege and keep upload paths separate from code, configs, service definitions, and executable content; use container immutability or mount options where possible. This limits arbitrary write blast radius and should be enforced within 30 days.
4. Alert on out-of-path writes — Create FIM/EDR detections for Frappe web or worker processes writing outside expected SCORM directories, especially under app code, sites/, templates, or served static paths. Detection engineering should be in place within 30 days.
5. Tighten account assurance — Require MFA for course-authoring accounts and review recent sign-ins, especially for shared training/admin identities. Since the exploit begins with a trusted editor account, identity controls materially reduce reachable risk and should be enforced within 30 days.

Run this on the Linux host or container that runs Frappe LMS, ideally from the bench root or with the bench root passed as an argument. Invoke it as bash verify_cve_2026_39405.sh /opt/frappe-bench or simply bash verify_cve_2026_39405.sh from the bench directory; it needs only read access to app metadata and, if available, the bench command.

#!/usr/bin/env bash
# verify_cve_2026_39405.sh
# Checks whether a Frappe LMS installation is vulnerable to CVE-2026-39405
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET_VERSION="2.50.1"
BENCH_ROOT="${1:-$(pwd)}"

vercmp() {
  # returns: 0 equal, 1 greater, 2 less
  local a="$1" b="$2"
  if [[ "$a" == "$b" ]]; then
    return 0
  fi
  local first
  first=$(printf '%s\n%s\n' "$a" "$b" | sort -V | head -n1)
  if [[ "$first" == "$a" ]]; then
    return 2
  else
    return 1
  fi
}

normalize_version() {
  local v="$1"
  v="${v#v}"
  v="${v%%[-+~]*}"
  printf '%s' "$v"
}

extract_from_bench_version() {
  local out line v
  if ! command -v bench >/dev/null 2>&1; then
    return 1
  fi
  out=$(cd "$BENCH_ROOT" 2>/dev/null && bench version 2>/dev/null) || return 1
  while IFS= read -r line; do
    case "$line" in
      lms*|*" lms "*|*"lms "*)
        v=$(printf '%s' "$line" | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)
        if [[ -n "$v" ]]; then
          printf '%s' "$v"
          return 0
        fi
        ;;
    esac
  done <<< "$out"
  return 1
}

extract_from_pyproject() {
  local file line v
  for file in \
    "$BENCH_ROOT/apps/lms/pyproject.toml" \
    "$BENCH_ROOT/frappe-bench/apps/lms/pyproject.toml"; do
    [[ -f "$file" ]] || continue
    line=$(grep -E '^version\s*=\s*"[0-9]+\.[0-9]+\.[0-9]+"' "$file" 2>/dev/null | head -n1 || true)
    v=$(printf '%s' "$line" | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)
    if [[ -n "$v" ]]; then
      printf '%s' "$v"
      return 0
    fi
  done
  return 1
}

extract_from_git_tag() {
  local dir v
  for dir in \
    "$BENCH_ROOT/apps/lms" \
    "$BENCH_ROOT/frappe-bench/apps/lms"; do
    [[ -d "$dir/.git" ]] || continue
    v=$(git -C "$dir" describe --tags --abbrev=0 2>/dev/null | grep -Eo 'v?[0-9]+\.[0-9]+\.[0-9]+' | head -n1 || true)
    if [[ -n "$v" ]]; then
      normalize_version "$v"
      return 0
    fi
  done
  return 1
}

VERSION=""
METHOD=""

if VERSION=$(extract_from_bench_version); then
  METHOD="bench version"
elif VERSION=$(extract_from_pyproject); then
  METHOD="pyproject.toml"
elif VERSION=$(extract_from_git_tag); then
  METHOD="git tag"
else
  echo "UNKNOWN - could not determine installed Frappe LMS version from bench, pyproject, or git metadata under: $BENCH_ROOT"
  exit 2
fi

VERSION=$(normalize_version "$VERSION")

if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
  echo "UNKNOWN - parsed version '$VERSION' via $METHOD but it is not comparable"
  exit 2
fi

vercmp "$VERSION" "$TARGET_VERSION"
case $? in
  0)
    echo "PATCHED - detected Frappe LMS $VERSION via $METHOD (fixed version is $TARGET_VERSION)"
    exit 0
    ;;
  1)
    echo "PATCHED - detected Frappe LMS $VERSION via $METHOD (newer than fixed version $TARGET_VERSION)"
    exit 0
    ;;
  2)
    echo "VULNERABLE - detected Frappe LMS $VERSION via $METHOD (affected: $TARGET_VERSION and below per advisory wording)"
    exit 1
    ;;
esac

echo "UNKNOWN - unexpected version comparison failure"
exit 2

Sources

1. NVD CVE-2026-39405
2. GitHub Security Advisory GHSA-mxh7-g3r7-g96h
3. Frappe LMS release v2.50.1
4. Patch PR #2274
5. Frappe LMS repository README / deployment notes
6. Tenable CVE page with EPSS snapshot
7. Debian security tracker