Vulnerability · Published Aug 9, 2025 · Assigned by GitHub_M

CVE-2025-55006Frappe Learning Holds Potential for Malicious SVG Upload in Image Upload Feature

Medium 4.3

In plain English

A medium-severity improper input validation in lms from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 78.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Frappe Learning is a learning system that helps users structure their content. In versions 2.33.0 and below, the image upload functionality did not adequately sanitize uploaded SVG files. This allowed users to upload SVG files containing embedded JavaScript or other potentially malicious content. Malicious SVG files could be used to execute arbitrary scripts in the context of other users. A fix for this issue is planned for version 2.34.0.

Affected products (as reported)

Vendor	Product	Versions
frappe	lms	<= 2.33.0

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

References

https://github.com/frappe/lms/security/advisories/GHSA-mvxw-r9x4-3vrr x_refsource_CONFIRM