---
id: CVE-2026-85272
title: >-
  Open edX Platform enables the authoring and delivery of online learning at any
  scale
summary: >-
  Open edX Platform enables the authoring and delivery of online learning at any
  scale. From Aspen.1 until Ulmo and Verawood.1,
  openedx/core/lib/extract_archive.py uses _is_bad_path to validate
  safe_extractall targets by comparing resolved…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-22
vendor: openedx
product: openedx-platform
affected:
  - 'openedx-platform >= release/aspen.1, < release/ulmo.4'
  - 'openedx-platform >= release/aspen.1, < release/verawood.1'
published: '2026-09-18'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:20:08.527'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85272'
references:
  - url: >-
      https://github.com/openedx/openedx-platform/commit/8422334e2063015a28b6460a34aa4bb4d8ae1ca8
    label: security-advisories@github.com
  - url: >-
      https://github.com/openedx/openedx-platform/commit/97de0586d878936c9f97c03fdaa20346ee8eac29
    label: security-advisories@github.com
  - url: >-
      https://github.com/openedx/openedx-platform/commit/e552907ff33a7b2e53f99b819123c9dacdfc127a
    label: security-advisories@github.com
  - url: 'https://github.com/openedx/openedx-platform/releases/tag/release/ulmo.4'
    label: security-advisories@github.com
  - url: >-
      https://github.com/openedx/openedx-platform/releases/tag/release/verawood.1
    label: security-advisories@github.com
  - url: >-
      https://github.com/openedx/openedx-platform/security/advisories/GHSA-6cmm-8875-5pcw
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00476
epssPercentile: 0.3854
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-21T16:09:28.591096Z'
ingestedAt: '2026-09-18T20:51:25.793Z'
---

## Overview

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extract_archive.py uses _is_bad_path to validate safe_extractall targets by comparing resolved path strings with startswith instead of comparing path components. A course author or staff user with course import permission can submit a crafted .tar.gz archive through the import_olx flow initiated by cms.djangoapps.contentstore.views.import_export.import_handler. An archive member can therefore escape into a sibling course staging directory whose name shares the attacker's base64 directory prefix, causing limited cross-tenant file corruption. Zip archives are not practically affected because ZipFile.extractall strips parent traversal segments, and the advisory does not establish arbitrary filesystem writes, file reads, or direct code execution. This issue is fixed in Ulmo and Verawood.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.