Home

Description

EN DE

A vulnerability has been found in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. Impacted is an unknown function of the file /api/v1/courses/ of the component Course Thumbnail Handler. The manipulation of the argument thumbnail leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Eine Schwachstelle wurde in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca gefunden. Es betrifft eine unbekannte Funktion der Datei /api/v1/courses/ der Komponente Course Thumbnail Handler. Mit der Manipulation des Arguments thumbnail mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Der Angriff kann remote ausgeführt werden. Der Exploit steht zur öffentlichen Verfügung. Dieses Produkt verzichtet auf eine Versionierung und verwendet stattdessen Rolling Releases. Deshalb sind keine Details zu betroffenen oder zu aktualisierende Versionen vorhanden.

PUBLISHED Reserved 2025-10-26 | Published 2025-10-27 | Updated 2025-10-27 | Assigner VulDB




MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
MEDIUM: 6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
MEDIUM: 6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
6.5AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR

Problem types

Unrestricted Upload

Improper Access Controls

Timeline

2025-10-26:Advisory disclosed
2025-10-26:VulDB entry created
2025-10-26:VulDB entry last update

Credits

KhanMarshal (VulDB User) reporter

References

vuldb.com/?id.329940 (VDB-329940 | LearnHouse Course Thumbnail courses unrestricted upload) vdb-entry technical-description

vuldb.com/?ctiid.329940 (VDB-329940 | CTI Indicators (IOB, IOC, TTP, IOA)) signature permissions-required

vuldb.com/?submit.674145 (Submit #674145 | LearnHouse learnhouse 98dfad76aad70711a8113f6c1fdabfccf10509ca Client-Side Enforcement of Server-Side Security) third-party-advisory

gist.github.com/KhanMarshaI/ef07d20eb1cbe30c71722fbded7cc056 exploit

cve.org (CVE-2025-12268)

nvd.nist.gov (CVE-2025-12268)

Download JSON