Exploit discussion active in current signal (1 latest mentions)
Immediate actions
Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Recommended action window: High priority (within 72h)
NVD description
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.50.0 and below, a user with course editing role could upload a SCORM ZIP package to write files outside the intended directory. This issue has been resolved in version 2.50.1.
student bio. admin views profile. RCE on the LMS box.
Frappe LMS. CVE-2026-34606 + CVE-2026-39405.
sanitizer strips <script>. BeautifulSoup get_text() glues the pieces back into a live payload.
admin hits the profile. XSS fires.
SCORM zip chapter title is path traversal. extract into apps/lms and overwrite http://api.py.
student to shell. fixed in 2.50.1.
credit: Nicholas Hefty / @rhinosecurity
https://rhinosecuritylabs.com/research/multiple-vulnerabilities-in-frappe-lms-leading-to-remote-code-execution/
PoC: https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2026-39405
#AppSec#ExploitDev#InfoSec
Post summary
Frappe LMS vulns chain XSS and path traversal to RCE; PoC linked and fixed in v2.50.1.
Two chained CVEs in Frappe LMS let a student-level user achieve RCE on the server. CVE-2026-39405 (path traversal to RCE) and CVE-2026-34606 (stored XSS sanitization bypass) combine into a full exploit chain. Patch to v2.50.1 immediately.
- CVE-2026-39405: The extract_package function passes an unsanitized chapter title into os.path.join before extracting a SCORM ZIP. A title like ../../../../../apps/lms/lms/lms lets an attacker overwrite http://api.py with a backdoored version. The backdoor listens on the public get_job_details endpoint, executing shell commands when the string |$> appears in the job parameter.
- CVE-2026-34606: Frappe LMS sanitizes rich-text on submission, but passes stored HTML through BeautifulSoup's get_text() to generate profile previews. get_text() reassembles split text nodes into a valid script tag without re-sanitizing, so a bio payload like p tags splitting script>alert()< reassembles into a live XSS payload visible to any viewer.
- The chain: student injects XSS into their bio, an admin views the profile, the payload triggers the SCORM upload and overwrites http://api.py, then the backdoor endpoint is open to unauthenticated callers.
Confirmed vulnerable: v2.44.0. Fixed: v2.50.1. PoC code is published in the Rhino Security Labs CVE GitHub repository.
Hunt for unexpected modifications to apps/lms/lms/api.py and review web server logs for POST requests to /api/method/lms.lms.api.get_job_details containing |$>.
#DFIR_Radar
Post summary
The post describes a detailed two-CVE exploit chain in Frappe LMS that enables student-level RCE, references published PoC code, and provides a specific fixed version, but does not report active in-the-wild exploitation.
