Impact

• Path traversal vulnerability in the SCORM file renderer lets attacker to read arbitrary files on the server.

Patches

• File paths are now checked to stay within the SCORM directory before serving.

Acknowledgement

• Credits to Aizzat Azman and Ahmed Reda