VulnSocial

CVE-2026-34606Patch(frappe / learning)

MEDIUMCVSS 6.1 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch frappe learning systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. From version 2.27.0 to before version 2.48.0, Frappe LMS was vulnerable to stored XSS. This issue has been patched in version 2.48.0.

frappe CVEsBack to dashboard
4.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-79

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • learning

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 2 signals
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • Peaked 1d ago at 1 mentions (2026-09-15); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
frappe
Products
learning

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-15: 1Mentions · 2026-09-16: 1PoC Mentioned / Linked · 2026-09-15: 1PoC Mentioned / Linked · 2026-09-16: 1Exploit Tool / Code · 2026-09-16: 1Patch / Workaround · 2026-09-15: 1Patch / Workaround · 2026-09-16: 1Technical Details · 2026-09-15: 1Technical Details · 2026-09-16: 109-1509-16
Signal classification2 categories
Patch
150.0%
Exploit
150.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-09-151
Patch1
2026-09-161
Exploit1
Full discourse2 posts
  • Mr.Niko@_MrNiko
    Exploit

    student bio. admin views profile. RCE on the LMS box. Frappe LMS. CVE-2026-34606 + CVE-2026-39405. sanitizer strips <script>. BeautifulSoup get_text() glues the pieces back into a live payload. admin hits the profile. XSS fires. SCORM zip chapter title is path traversal. extract into apps/lms and overwrite http://api.py. student to shell. fixed in 2.50.1. credit: Nicholas Hefty / @rhinosecurity https://rhinosecuritylabs.com/research/multiple-vulnerabilities-in-frappe-lms-leading-to-remote-code-execution/ PoC: https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2026-39405 #AppSec #ExploitDev #InfoSec

    Post summary

    The post details two CVEs in Frappe LMS (2026-34606, 2026-39405) leading to RCE via path traversal and XSS, provides a linked exploit repository, and notes a fix in version 2.50.1. The explicit naming of a functional exploit tool (GitHub repo) and lack of active exploitation claims elevate the classification to Exploit.

    10001294
    1.3K followersView on X
  • DFIR Radar@DFIR_Radar
    Patch

    Two chained CVEs in Frappe LMS let a student-level user achieve RCE on the server. CVE-2026-39405 (path traversal to RCE) and CVE-2026-34606 (stored XSS sanitization bypass) combine into a full exploit chain. Patch to v2.50.1 immediately. - CVE-2026-39405: The extract_package function passes an unsanitized chapter title into os.path.join before extracting a SCORM ZIP. A title like ../../../../../apps/lms/lms/lms lets an attacker overwrite http://api.py with a backdoored version. The backdoor listens on the public get_job_details endpoint, executing shell commands when the string |$> appears in the job parameter. - CVE-2026-34606: Frappe LMS sanitizes rich-text on submission, but passes stored HTML through BeautifulSoup's get_text() to generate profile previews. get_text() reassembles split text nodes into a valid script tag without re-sanitizing, so a bio payload like p tags splitting script>alert()< reassembles into a live XSS payload visible to any viewer. - The chain: student injects XSS into their bio, an admin views the profile, the payload triggers the SCORM upload and overwrites http://api.py, then the backdoor endpoint is open to unauthenticated callers. Confirmed vulnerable: v2.44.0. Fixed: v2.50.1. PoC code is published in the Rhino Security Labs CVE GitHub repository. Hunt for unexpected modifications to apps/lms/lms/api.py and review web server logs for POST requests to /api/method/lms.lms.api.get_job_details containing |$>. #DFIR_Radar

    Post summary

    Two chained vulnerabilities in Frappe LMS allow a low‑privileged user to achieve remote code execution via path traversal and XSS bypass; a patch to version 2.50.1 is available, and a proof‑of‑concept has been released.

    10010272
    1.9K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appfrappelearning---

Explore more

Back to dashboardfrappe CVEslearning vulnerabilities