CVE-2025-55006

Description

Frappe Learning is a learning system that helps users structure their content. In versions 2.33.0 and below, the image upload functionality did not adequately sanitize uploaded SVG files. This allowed users to upload SVG files containing embedded JavaScript or other potentially malicious content. Malicious SVG files could be used to execute arbitrary scripts in the context of other users. A fix for this issue is planned for version 2.34.0.

PUBLISHED Reserved 2025-08-04 | Published 2025-08-09 | Updated 2025-08-11 | Assigner GitHub_M

Problem types

CWE-20: Improper Input Validation

Product status

References

github.com/...pe/lms/security/advisories/GHSA-mvxw-r9x4-3vrr

cve.org (CVE-2025-55006)

nvd.nist.gov (CVE-2025-55006)

Download JSON