CVE-2025-55006

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-55006
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55006.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-55006
Aliases
Published
2025-08-09T02:01:57.136Z
Modified
2026-07-15T01:48:51.375131047Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Frappe Learning Holds Potential for Malicious SVG Upload in Image Upload Feature
Details

Frappe Learning is a learning system that helps users structure their content. In versions 2.33.0 and below, the image upload functionality did not adequately sanitize uploaded SVG files. This allowed users to upload SVG files containing embedded JavaScript or other potentially malicious content. Malicious SVG files could be used to execute arbitrary scripts in the context of other users. A fix for this issue is planned for version 2.34.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55006.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-20"
    ]
}
References

Affected packages

Git / github.com/frappe/lms

Affected ranges

Type
GIT
Repo
https://github.com/frappe/lms
Events
Introduced
63d613a88e10e23851bc6d76d0daa2de0c753c21
Fixed
5ff100da27ef81ee093a79287f75bffb6a1c9197
Database specific 
{
    "cpe": "cpe:2.3:a:frappe:learning:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.33.0"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.34.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

v2.*
v2.0.0
v2.0.1
v2.1.0
v2.10.0
v2.11.0
v2.12.0
v2.13.0
v2.14.0
v2.15.0
v2.16.0
v2.17.0
v2.18.0
v2.19.0
v2.2.0
v2.20.0
v2.21.0
v2.22.0
v2.23.0
v2.24.0
v2.25.0
v2.26.0
v2.27.0
v2.28.0
v2.28.1
v2.29.0
v2.3.0
v2.30.0
v2.31.0
v2.32.0
v2.32.1
v2.32.2
v2.33.0
v2.4.0
v2.5.0
v2.6.0
v2.7.0
v2.8.0
v2.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55006.json"