CVE-2025-55006 - CVE House

Back to Database

Status published Medium CVE-2025-55006

Frappe Learning Holds Potential for Malicious SVG Upload in Image Upload Feature

4.3 CVSS

Vulnerability Description

Frappe Learning is a learning system that helps users structure their content. In versions 2.33.0 and below, the image upload functionality did not adequately sanitize uploaded SVG files. This allowed users to upload SVG files containing embedded JavaScript or other potentially malicious content. Malicious SVG files could be used to execute arbitrary scripts in the context of other users. A fix for this issue is planned for version 2.34.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-55006

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://github.com/frappe/lms/security/advisories/GHSA-mvxw-r9x4-3vrr

More from frappe

View All →

Certain Frappe requests are vulnerable to Path Traversal

Frappe may be vulnerable remote code execution due to server-side template injection

Frappe CRM vulnerable to authenticated XSS via website field

Frappe Authenticated Users can Execute JavaScript through its Job Form

Frappe authenticated users can execute XSS through form description fields

Affected Vendor

frappe

View all reports →

Affected Software

lms

Vulnerable Versions:

<= 2.33.0

Timeline

Official Publish: August 9th, 2025

Last Modified: August 11th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation