High severity · published Aug 9, 2025
CVE-2025-55006
Frappe Learning is a learning system that helps users structure their content
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
Frappe Learning is a learning system that helps users structure their content. In versions 2.33.0 and below, the image upload functionality did not adequately sanitize uploaded SVG files. This allowed users to upload SVG files containing embedded JavaScript or other potentially malicious content. Malicious SVG files could be used to execute arbitrary scripts in the context of other users. A fix for this issue is planned for version 2.34.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LE
Learning · Frappe
2.0.0 before 2.34.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-55006
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-55006
Vendor Advisory
https://github.com/frappe/lms/security/advisories/GHSA-mvxw-r9x4-3vrr
More from Learning
9.8
CVE-2023-42807
Frappe LMS is an open source learning management system
6.5
CVE-2025-66581
Frappe Learning Management System (LMS) is a learning system that helps users structure their content
6.1
CVE-2026-34606
Stored XSS in Frappe LMS
6.1
CVE-2025-11282
A vulnerability was found in Frappe LMS 2.34.x/2.35.0
6.1
CVE-2023-5555
Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4