Disclosure summary
Frappe Learning is a learning system that helps users structure their content. In versions prior to 2.38.0, the system did stored the attachments uploaded by the students in their assignments as public files. This issue potentially exposed student-uploaded files to the public. Anyone with the file URL could access these files without authentication. The issue has been fixed in version 2.38.0 by ensuring all student-uploaded assignment attachments are stored as private files by default.
Source-reported weakness categories
CWE-200
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2025-62158
Open original source · Updated Oct 08, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| frappe | learning | 2.37.0 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Patch
- github.com — Mitigation, Vendor Advisory
PUBLISHED 2025-10-10T16:15:39-04:00
MODIFIED 2026-10-08T09:10:00-04:00
INGESTED 2026-10-08T12:30:37-04:00