CVE-2026-39598: Academy LMS Pro File Upload RCE Vulnerability – Patch to 3.5.2

Technical summary

CVE-2026-39598 is an unrestricted file upload vulnerability (CWE-434) in Academy LMS Pro that fails to properly validate uploaded file types. An authenticated administrator can circumvent file type restrictions and upload a web shell to the web server's document root or accessible directories. The vulnerability requires high privilege (PR:H) and is not easily exploitable due to attack complexity, but once successful, provides the attacker with arbitrary code execution in the context of the web application. The CVSS 3.1 score of 8.0 (HIGH) reflects the high impact on confidentiality, integrity, and availability across the system boundary.

Business impact

Successful exploitation enables attackers with admin access to establish persistent backdoors, exfiltrate sensitive learning data and user credentials, modify course content, disrupt service availability, and potentially pivot to other internal systems. For educational institutions relying on Academy LMS Pro, this translates to loss of data integrity, regulatory compliance violations (FERPA, GDPR), reputational damage, and remediation costs. The attack surface is limited to high-privileged users, but insider threats or compromised admin accounts pose a material risk.

Affected systems

All versions of Kodezen LLC Academy LMS Pro before version 3.5.2 are vulnerable. Installations running version 3.5.2 or later are protected by the fix. Organizations should verify their current deployment version immediately.

Exploitability

Exploitation requires administrative credentials or session compromise—a significant barrier that limits the threat actor profile to insiders, account takeover scenarios, or attackers who have already gained admin access through other means. The attack is not remotely exploitable by unauthenticated users. However, the attack complexity is rated as high rather than low, suggesting some environmental factors or additional preconditions beyond simple file upload. Once access is granted, the actual upload and execution is straightforward. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities catalog, indicating no active, widespread exploitation has been publicly disclosed or reported.

Remediation

Organizations must upgrade to Academy LMS Pro version 3.5.2 or later without delay. This version includes file type validation and upload restrictions that prevent malicious file uploads. During the upgrade window, apply the principle of least privilege to administrative accounts, monitor admin activity logs for suspicious uploads, and audit existing file system permissions to detect any previously placed web shells.

Patch guidance

Apply the vendor's upgrade to version 3.5.2 or later as soon as feasible. Verify the update against Kodezen's official release notes and security advisories to confirm the file upload vulnerability is addressed. Test the patch in a staging environment before production deployment to ensure compatibility with existing course content and user integrations. Consider scheduling the upgrade during a maintenance window to minimize disruption to active learners.

Detection guidance

Monitor Academy LMS Pro upload directories for unexpected executable files (.php, .jsp, .aspx, .exe, .sh, .py) or suspicious file modifications occurring shortly after admin login events. Review web server access logs for unusual POST requests to upload endpoints and subsequent GET/execution requests to newly created files. Audit the change logs within Academy LMS Pro for any file uploads by high-privileged accounts. Implement file integrity monitoring on the web root and upload directories to detect unauthorized changes. Set up alerts on failed file type validations if such logging is available.

Why prioritize this

Although this vulnerability requires administrative access and is not actively exploited in the wild, the combination of high CVSS score (8.0), broad system impact, and the criticality of LMS platforms in educational institutions warrants prompt patching. The risk is especially acute in institutions with weak privileged account security, remote administrators, or federated identity systems that might increase admin account compromise likelihood. The absence of active exploitation does not diminish the severity of the underlying code execution risk.

Risk score, explained

The CVSS 3.1 score of 8.0 (HIGH) reflects a scenario where an authenticated high-privileged user can upload a web shell, resulting in high impact across confidentiality (C:H), integrity (I:H), and availability (A:H) with a changed scope (S:C). The attack complexity is rated high (AC:H), which prevents a higher critical rating despite the severe impact. No user interaction is required (UI:N), and network accessibility (AV:N) is assumed. The score appropriately captures that this is a serious vulnerability for organizations running vulnerable versions, though its impact is constrained by the administrative privilege requirement.

Frequently asked questions