Vulnerability · Published Oct 10, 2025 · Assigned by GitHub_M

CVE-2025-62158Frappe had attachments made by students to their assignments of type Text set to public

Low 2.7

In plain English

A low-severity information exposure in lms from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 4.0)2.7Low

Exploit odds (30 days)0.3%top 78.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Frappe Learning is a learning system that helps users structure their content. In versions prior to 2.38.0, the system did stored the attachments uploaded by the students in their assignments as public files. This issue potentially exposed student-uploaded files to the public. Anyone with the file URL could access these files without authentication. The issue has been fixed in version 2.38.0 by ensuring all student-uploaded assignment attachments are stored as private files by default.

Affected products (as reported)

Vendor	Product	Versions
frappe	lms	< 2.38.0

Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

References

https://github.com/frappe/lms/security/advisories/GHSA-h6fh-7f24-f2j5 x_refsource_CONFIRM
https://github.com/frappe/lms/commit/78640561f558a6c7396f8be48874f79a54f03420 x_refsource_MISC