CVE-2025-55006

Frappe Learning Holds Potential for Malicious SVG Upload in Image Upload Feature

State: Published
Severity: 4.3 Medium
Published: Aug 9, 2025
Updated: Aug 11, 2025
Reserved: Aug 4, 2025

Description

Frappe Learning is a learning system that helps users structure their content. In versions 2.33.0 and below, the image upload functionality did not adequately sanitize uploaded SVG files. This allowed users to upload SVG files containing embedded JavaScript or other potentially malicious content. Malicious SVG files could be used to execute arbitrary scripts in the context of other users. A fix for this issue is planned for version 2.34.0.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L	GitHub_M

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
lmsfrappe	<= 2.33.0Affected

References

https://github.com/frappe/lms/security/advisories/GHSA-mvxw-r9x4-3vrr

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.