Frappe LMS RCE via Chained XSS & Path Traversal (CVE‑2026‑39405)

Frappe LMS is vulnerable to remote code execution because a stored XSS in profile bios can be combined with a SCORM file‑upload path‑traversal flaw (CVE‑2026‑39405), allowing a student‑level attacker to run code on the server when an administrator views the malicious profile.

What specific flaws enable the RCE chain?

The first flaw is a stored cross‑site scripting (XSS) vulnerability that renders user‑supplied image filenames in profile bio previews without proper sanitisation, tracked as CVE‑2026‑34606. When a crafted filename contains JavaScript, the script runs in any admin’s browser who views the profile.

The second flaw is a path‑traversal issue in the SCORM‑package upload endpoint. Attackers can embed ".." sequences in the archive to write files outside the intended directory, effectively placing a web‑shell on the server. This vulnerability is identified as CVE‑2026‑39405.

"The two bugs together let a low‑privilege student hijack the server once an admin inspects their profile," the Rhino Security Labs report notes.

Who is at risk from these vulnerabilities?

Any organization that runs Frappe LMS version 2.44.0 or earlier is exposed. Educational institutions, corporate training portals, and NGOs that host courses on the platform inherit the risk because the flaws are present in the core codebase.

Even if an organization limits student permissions, the stored XSS bypasses those controls because the payload executes in the admin’s browser, not the student’s session.

How do attackers exploit the chained bugs in practice?

An attacker first creates a malicious profile, embedding a specially crafted image filename that contains JavaScript. The XSS payload is stored on the server and waits for a privileged user to view the profile.

Next, the attacker uploads a SCORM package that includes a file path like "../../../../tmp/webshell.php". The path‑traversal bug causes the server to write the web‑shell to a location reachable via the web server.

When an admin later clicks on the attacker’s profile, the XSS runs, loading the web‑shell URL and executing arbitrary commands on the host. This chain elevates a student‑level account to full server compromise.

What mitigation steps should administrators take right now?

Apply the patches released by the Frappe maintainers that address both CVE‑2026‑34606 and CVE‑2026‑39405. If patches are unavailable, temporarily disable profile bio previews and restrict SCORM uploads to trusted sources.

Implement a web‑application firewall (WAF) rule that blocks ".." sequences in file paths and sanitises image filenames. Regularly scan for unexpected files in the web‑root, especially in directories used for SCORM content.

• Update to the latest Frappe LMS release as soon as it becomes available.
• Enforce strict content‑security‑policy (CSP) headers to mitigate XSS impact.
• Conduct periodic penetration testing focused on file‑upload and user‑generated content vectors.

What does this mean for your security posture?

The Frappe LMS case illustrates how seemingly unrelated bugs can be chained to achieve powerful attacks. Organizations should treat each vulnerability as a potential building block for larger exploits and adopt a defense‑in‑depth mindset.

Beyond patching, maintain an inventory of all third‑party learning platforms, run regular asset‑discovery scans, and monitor logs for anomalous file‑upload activity. By combining proactive scanning with rapid remediation, you reduce the attack surface and limit the window of opportunity for threat actors.

What this means for you

If you run Frappe LMS, prioritize the immediate application of security updates and review your upload handling logic. Even if you are not directly using the platform, the lesson applies: chained vulnerabilities can turn low‑privilege flaws into full‑scale compromises, so continuous monitoring and layered defenses are essential.

Frequently asked questions

Can I still use Frappe LMS safely after the patches?

Yes, applying the official patches for CVE‑2026‑34606 and CVE‑2026‑39405 restores safe operation, but you should also enable CSP headers and monitor uploads to maintain defense in depth.

How can I detect if my LMS has been compromised by this chain?

Check server logs for unexpected file writes in the SCORM directories, look for unknown PHP or script files, and review admin activity for unexplained profile view events that triggered JavaScript.

Do other learning management systems have similar chained vulnerabilities?

While each platform differs, the pattern of combining stored XSS with insecure file uploads is common, so reviewing both input sanitisation and file‑path handling across any LMS is advisable.

What role does a web‑application firewall play against this attack?

A WAF can block malicious payloads such as ".." sequences in uploads and strip dangerous JavaScript from user‑generated content, reducing the chance that the two flaws can be chained together.