CVE-2025-59415

5.4 mediumEPSS 0.2%

Medium (5.4) in frappe learning. EPSS 0.2% chance of exploitation in the next 30 days.

Frappe Learning is a learning system that helps users structure their content. In versions 2.34.1 and below, there is a security vulnerability in Frappe Learning where the system did not adequately sanitize the content uploaded in the profile bio. Malicious SVG files could be used to execute arbitrary scripts in the context of other users.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-09-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

frappe:learning

References

https://github.com/frappe/lms/commit/ed162e254690772365d4d1365f176b59bc4db72d
https://github.com/frappe/lms/security/advisories/GHSA-h7gh-3vq5-96jx

Check your stack JSON