Vulnerability · Published Oct 27, 2025 · Assigned by VulDB

CVE-2025-12270LearnHouse Student Assignment Submission sub_file resource injection

Medium 4.3

In plain English

A medium-severity security flaw in LearnHouse. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 64.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. The impacted element is an unknown function of the file /api/v1/assignments/{assignment_id}/tasks/{task_id}/sub_file of the component Student Assignment Submission Handler. This manipulation causes improper control of resource identifiers. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
n/a	LearnHouse	98dfad76aad70711a8113f6c1fdabfccf10509ca

Weakness: CWE-99 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References

VDB-329942 | LearnHouse Student Assignment Submission sub_file resource injection vdb-entry
VDB-329942 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #674147 | LearnHouse learnhouse 98dfad76aad70711a8113f6c1fdabfccf10509ca Insecure Direct Object Reference (IDOR) third-party-advisory
https://gist.github.com/KhanMarshaI/f71f86fbd5d8e8363f9113a8c054c28b exploit