This vulnerability is a path traversal flaw in the Frappe Learning Management System that allows a user with course editing privileges to upload a SCORM ZIP package that extracts files outside the intended directory, thereby enabling arbitrary file creation or overwrite. The impact is the ability to write files to any location supported by the file system, which can be used to place malicious files in critical directories or web‑root directories, potentially leading to remote code execution or data tampering. The flaw is classified as CWE‑22, a classic directory traversal weakness.

Affected vendor is Frappe, product LMS. Versions 2.50.0 and all prior releases are vulnerable. Version 2.50.1 and later contain the fix.

The CVSS score of 9.4 signifies a critical severity. With no EPSS score available and no listing in KEV, this flaw remains a high‑risk, serious vulnerability for environments that use the affected LMS. Attackers would need to be authenticated and possess the course editing role, but once that condition is met they can craft a malicious SCORM archive to bypass directory restrictions. Given the authentication requirement, the risk of accidental exploitation is lower, but a compromised account poses a severe threat.