CVE-2026-23497: 
NixOS vulnerability analysis and mitigation

CVE-2026-23497 is a stored Cross-Site Scripting (XSS) vulnerability in Frappe Learning Management System (LMS) affecting versions 2.0.0 through 2.44.0. A low-privileged attacker can upload an image with a specially crafted filename that, when rendered on course or jobs pages, executes malicious JavaScript in the browsers of other users. The vulnerability was reported by Muhammad Saad Sabir, disclosed on January 14, 2026, and patched in version 2.45.0 (GitHub Advisory). It carries a CVSS v3.1 base score of 5.4 (Medium) (Feedly).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79). The application failed to sanitize image filenames before storing and rendering them on course and jobs pages, allowing an attacker to embed JavaScript payloads within a filename (e.g., <img src=x onerror=alert(1)>.jpg). The fix, committed as e7ccf0a, introduces sanitization of image filenames prior to saving by leveraging the existing escapeHTML and sanitizeHTML utility functions across CourseForm.vue, JobForm.vue, and BatchForm.vue (GitHub Commit). Exploitation requires low privileges (authenticated user with file upload access) and passive user interaction (a victim viewing the affected page) (GitHub Advisory).

Successful exploitation enables persistent script execution in the context of any user who views the affected course or jobs pages, including administrators. This can lead to session hijacking, credential theft, and unauthorized actions performed on behalf of authenticated users. Confidentiality and integrity impacts are limited in scope (low), and there is no direct availability impact; however, the changed scope means the attack can affect users beyond the attacker's own session (Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.047%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a low-privileged account with file upload capability, limiting the attacker pool but not eliminating risk in multi-tenant or open-registration LMS deployments.

1. Obtain a low-privileged account: Register or log in to a Frappe LMS instance running version 2.44.0 or earlier with access to course creation, job posting, or batch management features.
2. Craft a malicious filename: Prepare an image file with a filename containing an XSS payload, such as "><img src=x onerror=alert(document.cookie)>.jpg or a similarly crafted string that injects HTML/JavaScript.
3. Upload the image: Navigate to a course creation, job posting, or batch form and upload the maliciously named image file using the file upload control.
4. Payload stored: The application stores the unsanitized filename in the database and references it when rendering the course or jobs page.
5. Trigger execution: When any authenticated user (including administrators) visits the affected course or jobs page, the browser renders the unsanitized filename as HTML, executing the embedded JavaScript payload.
6. Achieve objective: The executed script can steal session cookies, perform actions on behalf of the victim, or redirect users to attacker-controlled pages (GitHub Advisory, GitHub Commit).

• File System: Image files uploaded with filenames containing HTML special characters or JavaScript keywords (e.g., <, >, onerror, script, alert) in the LMS file storage directory.
• Logs: Application or web server access logs showing file upload requests with URL-encoded or raw HTML/JavaScript characters in the filename parameter targeting course, job, or batch form endpoints.
• Network: Outbound requests from victim browsers to unexpected external domains shortly after visiting course or jobs pages, potentially indicating cookie exfiltration or beacon calls.
• Application Behavior: Unexpected JavaScript dialogs, redirects, or network requests observed by users browsing course or jobs pages on affected LMS instances.

Upgrade Frappe LMS to version 2.45.0 or later, which sanitizes image filenames before saving using escapeHTML and sanitizeHTML utilities (GitHub Commit, GitHub Advisory). As a temporary workaround prior to patching, restrict file upload capabilities to trusted users only and review existing uploaded files for suspicious filenames. Implementing a web application firewall (WAF) rule to block uploads with HTML/JavaScript characters in filenames can provide additional defense-in-depth.

The vulnerability was reported by security researcher Muhammad Saad Sabir and acknowledged by the Frappe LMS maintainers, who published the advisory and patch on January 14, 2026 (GitHub Advisory). The issue received routine coverage from vulnerability aggregators and was noted in a CISA weekly vulnerability summary for the week of January 12, 2026. No significant broader community debate or notable researcher commentary beyond standard disclosure has been observed.