Medium severity · published Sep 17, 2025
CVE-2025-59415
Frappe Learning is a learning system that helps users structure their content
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Frappe Learning is a learning system that helps users structure their content. In versions 2.34.1 and below, there is a security vulnerability in Frappe Learning where the system did not adequately sanitize the content uploaded in the profile bio. Malicious SVG files could be used to execute arbitrary scripts in the context of other users.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LE
Learning · Frappe
2.0.0 before 2.35.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59415
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59415
Patch
https://github.com/frappe/lms/commit/ed162e254690772365d4d1365f176b59bc4db72d
Vendor Advisory
https://github.com/frappe/lms/security/advisories/GHSA-h7gh-3vq5-96jx
More from Learning
9.8
CVE-2023-42807
Frappe LMS is an open source learning management system
8.8
CVE-2025-55006
Frappe Learning is a learning system that helps users structure their content
6.5
CVE-2025-66581
Frappe Learning Management System (LMS) is a learning system that helps users structure their content
6.1
CVE-2026-34606
Stored XSS in Frappe LMS
6.1
CVE-2025-11282
A vulnerability was found in Frappe LMS 2.34.x/2.35.0