CVE-2025-62158: Frappe Learning Info Disclosure Bug

CVE-2025-62158 Overview

CVE-2025-62158 is an information disclosure vulnerability in Frappe Learning, an open-source learning management system built on the Frappe framework. Versions prior to 2.38.0 store student-uploaded assignment attachments as public files. Any user who obtains or guesses a file URL can retrieve these attachments without authenticating to the platform. The issue was resolved in version 2.38.0, which marks all student-uploaded assignment attachments as private by default. This weakness is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Student assignment files uploaded through the Frappe Learning assignment editor can be accessed by anyone with the file URL, bypassing authentication controls.

Affected Products

Frappe Learning versions prior to 2.38.0
Frappe Learning 2.37.0 (confirmed vulnerable CPE)
Deployments using the assignment text editor upload feature

Discovery Timeline

2025-10-10 - CVE-2025-62158 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62158

Vulnerability Analysis

Frappe Learning allows students to attach files to assignment submissions using an in-browser text editor component. Prior to version 2.38.0, the upload handler for the assignment editor did not pass the private: true flag to the underlying Frappe file API. As a result, attachments were persisted under the framework's public files directory, which serves content without session validation.

Any authenticated file upload API in Frappe distinguishes between public and private storage locations. Public files are served directly from /files/ and require no authorization checks. Private files are served from /private/files/ behind a permissions layer. Because student assignment uploads defaulted to public, sensitive coursework, personal identifiers, or graded work became reachable to any unauthenticated visitor who possessed or discovered the URL.

Root Cause

The root cause is a missing upload argument in the Assignment.vue frontend component. The editor did not instruct the file upload API to store attachments privately, so the server-side default of public storage was applied.

Attack Vector

Exploitation requires network access to the Frappe Learning instance and knowledge of a file URL. URLs may be leaked through shared links, browser history, referer headers, indexed directories, or predictable path structures. No authentication or user interaction on the target account is required to fetch a file once its URL is known.

text

// Security patch in frontend/src/components/Assignment.vue
// fix: private file uploads in assignment text editor
 						@change="(val) => (answer = val)"
 						:editable="true"
 						:fixedMenu="true"
+						:uploadArgs="{
+							private: true,
+						}"
 						editorClass="prose-sm max-w-none border-b border-x bg-surface-gray-2 rounded-b-md py-1 px-2 min-h-[7rem]"
 					/>
 				</div>

Source: GitHub Commit 78640561. The patch adds the uploadArgs prop with private: true so that uploads from the assignment editor route through the private file store.

Detection Methods for CVE-2025-62158

Indicators of Compromise

Unauthenticated HTTP GET requests to /files/ paths containing assignment attachment names or student identifiers.
Access log entries showing successful 200 OK responses to /files/ URLs from IP addresses without associated user sessions.
Presence of student-owned files under the public sites/<site>/public/files/ directory on the Frappe host.

Detection Strategies

Audit the tabFile table in the Frappe database for records where is_private = 0 and attached_to_doctype references assignment or LMS submission doctypes.
Review web server and reverse proxy logs for external requests to /files/ URLs referencing course or assignment content.
Compare the installed Frappe Learning version against the fixed release 2.38.0 to determine exposure.

Monitoring Recommendations

Alert on anonymous access to file paths that correlate with LMS assignment documents.
Track file uploads created by users with the Student role and verify their is_private flag matches policy.
Monitor for external search engine indexing of the Frappe host's /files/ directory using site: queries.

How to Mitigate CVE-2025-62158

Immediate Actions Required

Upgrade Frappe Learning to version 2.38.0 or later on all production instances.
Identify existing assignment attachments stored publicly and convert them to private files through the Frappe file record settings.
Rotate or invalidate any shared assignment URLs that may have been distributed while public storage was in effect.

Patch Information

The fix is delivered in commit 78640561 and released in Frappe Learning 2.38.0. Details are documented in the GHSA-h6fh-7f24-f2j5 advisory. The patch sets private: true in the uploadArgs for the assignment text editor, ensuring subsequent uploads are stored under the private files path.

Workarounds

Restrict direct access to the /files/ path at the reverse proxy layer for LMS-related file names until the upgrade is applied.
Manually toggle the Is Private flag on existing assignment File documents through the Frappe desk interface.
Remove any public directory listing on the web server and disable search engine indexing of the Frappe host.

bash

# Upgrade Frappe Learning to the patched release
bench get-app --branch main lms https://github.com/frappe/lms
bench --site <site-name> install-app lms
bench update --apps lms
bench --site <site-name> migrate

# Verify installed version is >= 2.38.0
bench version | grep lms