CVE-2026-85272 - Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation
Brief
CVE ID : CVE-2026-85272
Published : Sept. 18, 2026, 8:27 p. m.
- 28 minutes ago
Description : Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen. 1 until Ulmo and Verawood. 1, openedx/core/lib/extract_archive. py uses _is_bad_path to validate safe_extractall targets by comparing resolved path strings with startswith instead of comparing path components. A course author or staff user with course import permission can submit a crafted . tar.
gz archive through the import_olx flow initiated by cms. djangoapps. contentstore. views. import_export. import_handler. An archive member can therefore escape into a sibling course staging directory whose name shares the attacker's base64 directory prefix, causing limited cross-tenant file corruption. Zip archives are not practically affected because ZipFile.