Frappe LMS versions prior to 2.52.1 are vulnerable to an unauthenticated path traversal attack that permits unauthorized access to sensitive server-side files.

This is a path traversal vulnerability (CWE-22) located in the SCORMRenderer.render function within lms/page_renderers.py. The application fails to validate that requested file paths remain within the intended public/scorm directory, enabling unauthenticated remote attackers to access arbitrary files on the underlying filesystem.

Successful exploitation of this flaw could result in the unauthorized disclosure of sensitive configuration files, environment variables, or user data, potentially leading to a full system compromise. Given the CVSS score of 8.7, this is a high-severity vulnerability that poses a significant risk to organizational confidentiality and should be addressed as a priority.

Immediate Action: Upgrade Frappe LMS to version 2.52.1 or later immediately to apply the necessary path validation fixes.

Proactive Monitoring: Monitor server logs for unusual file access patterns or HTTP requests containing directory traversal sequences such as double dots (..) directed at the SCORMRenderer endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming requests containing directory traversal sequences, which can provide temporary protection while the update is being staged.

Public Exploit Available: No

This vulnerability represents a critical security gap due to the ability for unauthenticated actors to read arbitrary files. IT administrators should prioritize upgrading to version 2.52.1 to eliminate the underlying path traversal flaw. Failure to patch may allow attackers to extract sensitive data, leading to severe operational and security consequences.