CVE-2025-62158
Last modified
CVE-2025-62158 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Frappe Learning is a learning system that helps users structure their content. In versions prior to 2.38.0, the system did stored the attachments uploaded by the students in their assignments as public files. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
Frappe Learning is a learning system that helps users structure their content. In versions prior to 2.38.0, the system did stored the attachments uploaded by the students in their assignments as public files. This issue potentially exposed student-uploaded files to the public. Anyone with the file URL could access these files without authentication. The issue has been fixed in version 2.38.0 by ensuring all student-uploaded assignment attachments are stored as private files by default.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Frappe | Learning | 2.37.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-62158?
How severe is CVE-2025-62158?
How do I fix CVE-2025-62158?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-62152Missing Authorization vulnerability in ConveyThis ConveyThis…5.3
- CVE-2025-62153Missing Authorization vulnerability in Graham Quick Interest…5.3
- CVE-2025-62154Missing Authorization vulnerability in recorp AI Content Wri…4.3
- CVE-2025-62155New API is a large language mode (LLM) gateway and artificia…8.5
- CVE-2025-62156Argo Workflows is an open source container-native workflow e…8.8
- CVE-2025-62157Argo Workflows is an open source container-native workflow e…6.5
- CVE-2025-62159External Secrets Operator reads information from a third-par…8.7
- CVE-2025-6216Allegra calculateTokenExpDate Password Recovery Authenticati…9.8
- CVE-2025-62161Youki is a container runtime written in Rust. In versions 0.…10
- CVE-2025-62162cel-rust is a Common Expression Language interpreter written…7.5
- CVE-2025-62164vLLM is an inference and serving engine for large language m…8.8
- CVE-2025-62166FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28…7.5
Are you affected by CVE-2025-62158?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST