CVE-2025-62158

Frappe Learning is a learning system that helps users structure their content. In versions prior to 2.38.0, the system did stored the attachments uploaded by the students in their assignments as public files. This issue potentially exposed student-uploaded files to the public. Anyone with the file URL could access these files without authentication. The issue has been fixed in version 2.38.0 by ensuring all student-uploaded assignment attachments are stored as private files by default.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/frappe/lms/commit/78640561f558a6c7396f8be48874f79a54f03420	Patch
https://github.com/frappe/lms/security/advisories/GHSA-h6fh-7f24-f2j5	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:frappe:learning:2.37.0:*:*:*:*:*:*:*

History

08 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Frappe Learning es un sistema de aprendizaje que ayuda a los usuarios a estructurar su contenido. En versiones anteriores a la 2.38.0, el sistema almacenaba los archivos adjuntos subidos por los estudiantes en sus tareas como archivos públicos. Este problema potencialmente exponía los archivos subidos por los estudiantes al público. Cualquiera con la URL del archivo podía acceder a estos archivos sin autenticación. El problema ha sido solucionado en la versión 2.38.0 al asegurar que todos los archivos adjuntos de tareas subidos por los estudiantes se almacenen como archivos privados por defecto.

Information

Published : 2025-10-10 20:15

Updated : 2026-10-08 13:10

NVD link : CVE-2025-62158

Mitre link : CVE-2025-62158

CVE.ORG link : CVE-2025-62158

JSON object : View

Products Affected

frappe

learning

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2025-62158", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62158", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-10T20:44:01.340992Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "frappe", "product": "lms", "versions": [{"status": "affected", "version": "< 2.38.0"}]}]}], "published": "2025-10-10T20:15:39.213", "references": [{"url": "https://github.com/frappe/lms/commit/78640561f558a6c7396f8be48874f79a54f03420", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/frappe/lms/security/advisories/GHSA-h6fh-7f24-f2j5", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Frappe Learning is a learning system that helps users structure their content. In versions prior to 2.38.0, the system did stored the attachments uploaded by the students in their assignments as public files. This issue potentially exposed student-uploaded files to the public. Anyone with the file URL could access these files without authentication. The issue has been fixed in version 2.38.0 by ensuring all student-uploaded assignment attachments are stored as private files by default."}, {"lang": "es", "value": "Frappe Learning es un sistema de aprendizaje que ayuda a los usuarios a estructurar su contenido. En versiones anteriores a la 2.38.0, el sistema almacenaba los archivos adjuntos subidos por los estudiantes en sus tareas como archivos p\u00fablicos. Este problema potencialmente expon\u00eda los archivos subidos por los estudiantes al p\u00fablico. Cualquiera con la URL del archivo pod\u00eda acceder a estos archivos sin autenticaci\u00f3n. El problema ha sido solucionado en la versi\u00f3n 2.38.0 al asegurar que todos los archivos adjuntos de tareas subidos por los estudiantes se almacenen como archivos privados por defecto."}], "lastModified": "2026-10-08T13:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:frappe:learning:2.37.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B63CD243-D066-4A45-8FC8-2ADCEFAD0A45"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}