Learners on edX Platform can download python_lib.zip
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The Open edX Platform is a learning management platform. Prior to commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, edxapp has no built-in protection against downloading the python_lib.zip asset from courses, which is a concern since it often contains custom grading code or answers to course problems. This potentially affects any course using custom Python-graded problem blocks. The openedx/configuration repo has had a patch since 2016 in the form of an nginx rule, but this was only intended as a temporary mitigation. As the configuration repo has been deprecated and we have not been able to locate any similar protection in Tutor, it is likely that most deployments have no protection against python_lib.zip being downloaded. The recommended mitigation, implemented in commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, restricts python_lib.zip downloads to just the course team and site staff/superusers.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| openedx | edx-platform | before 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba | 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba | Patch available | CNA |
- edx-platform Vendoropenedx Affected before 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba Fixed in 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba Patch available CNA
Remediation
- Fix · CNA edx-platform (openedx) Fixed in 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba
Timeline
- 2026-10-02 Threatist record created from CVE-2025-47942
References
Other 3
- https://github.com/openedx/edx-platform/security/advisories/GHSA-x5cm-2hpq-pw57
- https://github.com/openedx/edx-platform/commit/6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba
- https://github.com/edx/configuration/blob/3471fc036a6664cedd3e2d78403dca73bc1cda51/playbooks/roles/nginx/templates/edx/app/nginx/sites-available/python_lib.zip.j2
More openedx vulnerabilities
- TI-2026-31065 Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint CVSS 3.1CRITICAL 9.9
- TI-2022-22791 Drag and Drop XBlock v2 has XSS Issues in Xblock Input Fields CVSS 3.1HIGH 8.4
- TI-2026-31067 Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint CVSS 3.1HIGH 8.5
- TI-2026-38679 Open edX Platform: Insufficient Permission on set_course_mode_price() CVSS 3.1HIGH 7.6
- TI-2026-26980 Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API CVSS 3.1MEDIUM 5.3
- TI-2026-27540 Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter CVSS 3.1MEDIUM 6.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences