Medium severity · published Oct 10, 2025
CVE-2025-62158
Frappe Learning is a learning system that helps users structure their content
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
Frappe Learning is a learning system that helps users structure their content. In versions prior to 2.38.0, the system did stored the attachments uploaded by the students in their assignments as public files. This issue potentially exposed student-uploaded files to the public. Anyone with the file URL could access these files without authentication. The issue has been fixed in version 2.38.0 by ensuring all student-uploaded assignment attachments are stored as private files by default.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LE
Learning · Frappe
2.37.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-62158
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-62158
Patch
https://github.com/frappe/lms/commit/78640561f558a6c7396f8be48874f79a54f03420
Mitigation
https://github.com/frappe/lms/security/advisories/GHSA-h6fh-7f24-f2j5
More from Learning
9.8
CVE-2023-42807
Frappe LMS is an open source learning management system
8.8
CVE-2025-55006
Frappe Learning is a learning system that helps users structure their content
6.5
CVE-2025-66581
Frappe Learning Management System (LMS) is a learning system that helps users structure their content
6.1
CVE-2026-34606
Stored XSS in Frappe LMS
6.1
CVE-2025-11282
A vulnerability was found in Frappe LMS 2.34.x/2.35.0