CVE-2025-55006
Frappe Learning Holds Potential for Malicious SVG Upload in Image Upload Feature
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Frappe Learning Holds Potential for Malicious SVG Upload in Image Upload Feature
Frappe Learning is a learning system that helps users structure their content. In versions 2.33.0 and below, the image upload functionality did not adequately sanitize uploaded SVG files. This allowed users to upload SVG files containing embedded JavaScript or other potentially malicious content. Malicious SVG files could be used to execute arbitrary scripts in the context of other users. A fix for this issue is planned for version 2.34.0.
Reserved 2025-08-04 | Published 2025-08-09 | Updated 2025-08-09 | Assigner GitHub_MCWE-20: Improper Input Validation
github.com/...pe/lms/security/advisories/GHSA-mvxw-r9x4-3vrr
Support options
