CVE-2026-85272 (GCVE-0-2026-85272)
Vulnerability from cvelistv5
Published
2026-09-18 20:27
Modified
2026-09-21 16:13
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extract_archive.py uses _is_bad_path to validate safe_extractall targets by comparing resolved path strings with startswith instead of comparing path components. A course author or staff user with course import permission can submit a crafted .tar.gz archive through the import_olx flow initiated by cms.djangoapps.contentstore.views.import_export.import_handler. An archive member can therefore escape into a sibling course staging directory whose name shares the attacker's base64 directory prefix, causing limited cross-tenant file corruption. Zip archives are not practically affected because ZipFile.extractall strips parent traversal segments, and the advisory does not establish arbitrary filesystem writes, file reads, or direct code execution. This issue is fixed in Ulmo and Verawood.1.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| openedx | openedx-platform |
Version: >= release/aspen.1, < release/ulmo.4 Version: >= release/aspen.1, < release/verawood.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85272",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T16:09:28.591096Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T16:13:29.175Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openedx-platform",
"vendor": "openedx",
"versions": [
{
"status": "affected",
"version": "\u003e= release/aspen.1, \u003c release/ulmo.4"
},
{
"status": "affected",
"version": "\u003e= release/aspen.1, \u003c release/verawood.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extract_archive.py uses _is_bad_path to validate safe_extractall targets by comparing resolved path strings with startswith instead of comparing path components. A course author or staff user with course import permission can submit a crafted .tar.gz archive through the import_olx flow initiated by cms.djangoapps.contentstore.views.import_export.import_handler. An archive member can therefore escape into a sibling course staging directory whose name shares the attacker\u0027s base64 directory prefix, causing limited cross-tenant file corruption. Zip archives are not practically affected because ZipFile.extractall strips parent traversal segments, and the advisory does not establish arbitrary filesystem writes, file reads, or direct code execution. This issue is fixed in Ulmo and Verawood.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:27:44.396Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-6cmm-8875-5pcw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-6cmm-8875-5pcw"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/8422334e2063015a28b6460a34aa4bb4d8ae1ca8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/8422334e2063015a28b6460a34aa4bb4d8ae1ca8"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/97de0586d878936c9f97c03fdaa20346ee8eac29",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/97de0586d878936c9f97c03fdaa20346ee8eac29"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/e552907ff33a7b2e53f99b819123c9dacdfc127a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/e552907ff33a7b2e53f99b819123c9dacdfc127a"
},
{
"name": "https://github.com/openedx/openedx-platform/releases/tag/release/ulmo.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/releases/tag/release/ulmo.4"
},
{
"name": "https://github.com/openedx/openedx-platform/releases/tag/release/verawood.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/releases/tag/release/verawood.1"
}
],
"source": {
"advisory": "GHSA-6cmm-8875-5pcw",
"discovery": "UNKNOWN"
},
"title": "Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-85272",
"datePublished": "2026-09-18T20:27:44.396Z",
"dateReserved": "2026-09-03T16:37:49.260Z",
"dateUpdated": "2026-09-21T16:13:29.175Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-85272\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-21T16:09:28.591096Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-21T16:13:23.580Z\"}}], \"cna\": {\"title\": \"Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation\", \"source\": {\"advisory\": \"GHSA-6cmm-8875-5pcw\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"openedx\", \"product\": \"openedx-platform\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= release/aspen.1, \u003c release/ulmo.4\"}, {\"status\": \"affected\", \"version\": \"\u003e= release/aspen.1, \u003c release/verawood.1\"}]}], \"references\": [{\"url\": \"https://github.com/openedx/openedx-platform/security/advisories/GHSA-6cmm-8875-5pcw\", \"name\": \"https://github.com/openedx/openedx-platform/security/advisories/GHSA-6cmm-8875-5pcw\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/openedx/openedx-platform/commit/8422334e2063015a28b6460a34aa4bb4d8ae1ca8\", \"name\": \"https://github.com/openedx/openedx-platform/commit/8422334e2063015a28b6460a34aa4bb4d8ae1ca8\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/openedx/openedx-platform/commit/97de0586d878936c9f97c03fdaa20346ee8eac29\", \"name\": \"https://github.com/openedx/openedx-platform/commit/97de0586d878936c9f97c03fdaa20346ee8eac29\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/openedx/openedx-platform/commit/e552907ff33a7b2e53f99b819123c9dacdfc127a\", \"name\": \"https://github.com/openedx/openedx-platform/commit/e552907ff33a7b2e53f99b819123c9dacdfc127a\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/openedx/openedx-platform/releases/tag/release/ulmo.4\", \"name\": \"https://github.com/openedx/openedx-platform/releases/tag/release/ulmo.4\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/openedx/openedx-platform/releases/tag/release/verawood.1\", \"name\": \"https://github.com/openedx/openedx-platform/releases/tag/release/verawood.1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extract_archive.py uses _is_bad_path to validate safe_extractall targets by comparing resolved path strings with startswith instead of comparing path components. A course author or staff user with course import permission can submit a crafted .tar.gz archive through the import_olx flow initiated by cms.djangoapps.contentstore.views.import_export.import_handler. An archive member can therefore escape into a sibling course staging directory whose name shares the attacker\u0027s base64 directory prefix, causing limited cross-tenant file corruption. Zip archives are not practically affected because ZipFile.extractall strips parent traversal segments, and the advisory does not establish arbitrary filesystem writes, file reads, or direct code execution. This issue is fixed in Ulmo and Verawood.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-18T20:27:44.396Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-85272\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-21T16:13:29.175Z\", \"dateReserved\": \"2026-09-03T16:37:49.260Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-09-18T20:27:44.396Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…