CVE-2026-23497: Frappe Learning XSS Vulnerability

CVE-2026-23497 Overview

CVE-2026-23497 is a stored cross-site scripting (XSS) vulnerability in Frappe Learning Management System (LMS), an open-source platform used to structure educational content and job postings. The flaw affects versions 2.44.0 and earlier. An attacker can upload an image with a specially crafted filename containing JavaScript payloads. When the LMS renders the filename on course or jobs pages, the embedded script executes in the browser context of any user viewing the page. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated attackers can persist malicious JavaScript through image filenames, executing arbitrary script in the browsers of students, instructors, and administrators who view course or job pages.

Affected Products

Frappe Learning Management System (LMS) version 2.44.0
Frappe Learning Management System (LMS) versions prior to 2.44.0
Component identifier: frappe:learning

Discovery Timeline

2026-01-14 - CVE-2026-23497 published to the National Vulnerability Database
2026-01-16 - Last updated in NVD database

Technical Details for CVE-2026-23497

Vulnerability Analysis

The vulnerability is a stored XSS issue in the Frappe LMS rendering pipeline. When users upload images to course material or job listings, the application stores the original filename and later renders it as part of the page output without sufficient HTML encoding. An attacker who crafts a filename containing markup such as an <img> tag with an onerror handler or an inline <script> block can inject executable JavaScript into the resulting page.

Because the payload is stored server-side and rendered every time the affected page loads, any visitor to the course or jobs page becomes a target. The script runs with the privileges of the viewing user's session, enabling session token theft, forced actions through the LMS API, content defacement, and phishing overlays inside the trusted application domain.

Root Cause

The root cause is missing output encoding when image filenames are embedded into HTML templates on course and jobs pages. User-controlled input flows from the upload handler to the template renderer without being treated as untrusted data. The fix is published in commit e7ccf0a, which applies proper sanitization to filenames before rendering.

Attack Vector

Exploitation requires network access to a Frappe LMS instance and the ability to upload an image, which typically requires an authenticated user role with content contribution permissions. User interaction is required: a victim must visit the course or jobs page containing the malicious filename. No special privileges beyond standard upload rights are required on the attacker side.

The exploitation chain involves crafting an image file whose filename contains HTML or JavaScript syntax, uploading it through the LMS interface, and waiting for legitimate users to load the affected page. See the GitHub Security Advisory GHSA-78mq-3whw-69j5 for additional technical context.

Detection Methods for CVE-2026-23497

Indicators of Compromise

Image filenames in the LMS file store containing HTML tags, <script> blocks, or event handlers such as onerror= and onload=.
Unexpected outbound requests from user browsers to attacker-controlled domains when loading course or jobs pages.
Anomalous session activity originating from users immediately after they viewed a course or job listing.

Detection Strategies

Query the Frappe LMS file table for filenames matching regular expressions that detect angle brackets, quotes, or JavaScript event-handler keywords.
Inspect HTTP responses from course and jobs endpoints for unencoded markup inside filename rendering blocks.
Review web application firewall logs for upload requests where the filename parameter contains script-like syntax.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture script-source violations triggered by injected payloads.
Forward LMS application logs and reverse proxy access logs to a centralized analytics platform for correlation across upload and view events.
Alert on repeated uploads from a single account that produce filenames containing non-alphanumeric characters typical of XSS payloads.

How to Mitigate CVE-2026-23497

Immediate Actions Required

Upgrade Frappe LMS to the patched release that includes commit e7ccf0a (versions after 2.44.0).
Audit existing image filenames stored by the LMS and rename or remove any entries containing HTML or JavaScript syntax.
Invalidate active sessions for users who may have viewed affected course or jobs pages before the patch was applied.

Patch Information

The maintainers fixed the issue in commit e7ccf0a711d0e0ab5e6b28b7a1e4e0510b6b9543. Administrators should follow the upgrade instructions in the GitHub Security Advisory GHSA-78mq-3whw-69j5. Verify the deployed version reports a build later than 2.44.0 after the upgrade.

Workarounds

Restrict file upload permissions to a small set of trusted instructor accounts until the patch is applied.
Enforce a strict Content Security Policy that disallows inline scripts on course and jobs pages to reduce XSS impact.
Apply a reverse proxy rule that rejects multipart uploads whose filename field contains characters such as <, >, ", or '.

bash

# Example NGINX rule to block image uploads with suspicious filename characters
location /api/method/upload_file {
    if ($request_body ~* "filename=\"[^\"]*[<>\"']") {
        return 400;
    }
    proxy_pass http://frappe_lms_backend;
}