CVE-2025-12268 is a medium severity unrestricted file upload flaw in the LearnHouse course thumbnail handler, scored 6.3 by NVD. The project uses rolling releases and the vendor did not respond to disclosure, so no fixed version exists to name. Restrict uploads and watch the repository.
What's affected
The NVD record says LearnHouse up to commit 98dfad76aad70711a8113f6c1fdabfccf10509ca is affected. The vulnerable function is in the file /api/v1/courses/, in the component that handles course thumbnails. The thumbnail argument leads to an unrestricted upload.
LearnHouse uses a rolling release model, so the record says no version details for affected or updated releases are available. It also says the vendor was contacted early about the disclosure but did not respond in any way.
The record states that the attack can be started remotely and that an exploit has been disclosed to the public. The CVSS vector requires a low privilege account and rates impact as low across confidentiality, integrity and availability.
How to check if you're exposed
- Work out which commit of LearnHouse you run. If you deploy from a git clone, run
git rev-parse HEADin the checkout and compare it to the commit in the record. - If you run a container image, check which commit or build date the image was made from, and rebuild from the project's latest main branch if you cannot tell.
- Check who can create or edit courses. The attack needs an account, so the number of people with course creation rights shapes your exposure.
- Look at where thumbnails are stored and served from. Check whether uploaded files could be run as code by the server or reach a path that your web server executes.
What to do now
- Pull the latest code from the project and deploy it, then read the repository's recent commits for any change to the course thumbnail handler. The record does not confirm a fix, so check before you rely on it.
- Limit who can create courses and upload thumbnails to people you trust, and remove stale accounts.
- Serve uploaded files from a separate storage location or domain, with execution turned off, and a content type that is not guessed by the browser.
- If you write upload handlers, allow only known image types, check content and not only file extension, re-encode images, generate your own file names and enforce a size limit.
- Scan the files already uploaded for anything that is not an image.
Why it matters
The record lists CWE-434, unrestricted upload of a file with dangerous type, and CWE-284, improper access control. Upload features turn outsiders into authors of files on your server. If the application trusts the name or type the client sends, the file can end up somewhere it is treated as more than an image.
The score is medium because the vector needs an account and rates impact as low. For a learning platform, accounts are often easy to get, so check how open your registration is. A rolling release with a silent maintainer means you may need to patch your own copy.
The record does not mark this CVE as exploited and it is not in the CISA Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version is safe?
The record says no version details exist because LearnHouse is a rolling release. Compare your commit to recent repository history and check whether the thumbnail handler changed.
What is the safest way to accept image uploads?
Allow a short list of image types, verify the content, re-encode the image, store it outside the web root under a name you generate, and never serve it with a type the user chose.
Sources
Last reviewed: 19 October 2026.
