Medium severity · published Sep 17, 2025
CVE-2025-59415
Frappe Learning vulnerable to Malicious Content upload via Profile bio field
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Frappe Learning is a learning system that helps users structure their content. In versions 2.34.1 and below, there is a security vulnerability in Frappe Learning where the system did not adequately sanitize the content uploaded in the profile bio. Malicious SVG files could be used to execute arbitrary scripts in the context of other users.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LM
lms · frappe
<= 2.34.1 · source: vendor
LE
Learning · Frappe
2.0.0 before 2.35.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59415
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59415
Patch
https://github.com/frappe/lms/commit/ed162e254690772365d4d1365f176b59bc4db72d
Vendor Advisory
https://github.com/frappe/lms/security/advisories/GHSA-h7gh-3vq5-96jx
More from lms
9.4
CVE-2026-39405
Frappe has Path Transversal via SCORM
8.8
CVE-2025-55006
Frappe Learning Holds Potential for Malicious SVG Upload in Image Upload Feature
8.7
CVE-2026-54343
Frappe LMS: Path Traversal in SCORM File Serving
7.1
CVE-2026-39385
Frappe LMS enrollment bypass in paid courses via unrelated batch
6.5
CVE-2025-66581
Frappe LMS is Missing Server-Side Authorization in Business Logic