{"vulnerability": "cve-2026-39405", "sightings": [{"uuid": "f5a89da9-db99-4123-81e1-40d51aa1207c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-39405", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116610683716736422", "content": "\u26a0\ufe0f CRITICAL: Frappe LMS <2.50.1 is vulnerable (CVE-2026-39405, CVSS 9.4). Path traversal lets course editors write files outside restricted dirs via SCORM ZIP upload. Upgrade to 2.50.1 ASAP! https://radar.offseq.com/threat/cve-2026-39405-cwe-22-improper-limitation-of-a-pat-fc462187 #OffSeq #infosec #vuln #FrappeLMS", "creation_timestamp": "2026-05-21T04:30:26.050642Z"}, {"uuid": "081944a2-5945-4311-bab5-d7c1e3157794", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-39405", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mmdljlqjdq2y", "content": "CRITICAL: Frappe LMS <2.50.1 path traversal flaw lets course editors upload SCORM ZIPs that escape directory restrictions. Upgrade to 2.50.1 now! https://radar.offseq.com/threat/cve-2026-39405-cwe-22-improper-limitation-of-a-pat-fc462187 #OffSeq #security #FrappeLMS", "creation_timestamp": "2026-05-21T04:30:28.589719Z"}]}