CVE-2026-23497: Frappe LMS has a Stored XSS via Unsanitized Image Filename in Course and Jobs Pages

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-14 · updated 2026-06-17
Weakness: CWE-79

Description

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In 2.44.0 and earlier, there is a stored XSS vulnerability where a specially crafted image filename could execute malicious JavaScript when rendered on course or jobs pages.

Affected products

frappe Learning: from 2.0.0 before 2.45.0 — fixed in 2.45.0

How to fix

Upgrade to a fixed version: frappe Learning 2.45.0. Check the vendor advisory for mitigations.

References

https://github.com/frappe/lms/commit/e7ccf0a711d0e0ab5e6b28b7a1e4e0510b6b9543
https://github.com/frappe/lms/security/advisories/GHSA-78mq-3whw-69j5

Get alerted when CVE-2026-23497 or the next vulnerability affects your stack