Unrated severityNVD Advisory· Published Jul 10, 2026· Updated Jul 13, 2026
Frappe: TarSlip RCE in Package Import
CVE-2026-55852
Description
Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Import because tarfile members were not sufficiently checked before extraction. This issue is fixed in versions 16.23.0 and 15.112.0.
Affected products
1Patches
Vulnerability mechanics
References
9- github.com/frappe/frappe/commit/3c75f13fd7d4441a880dd236450277dc37fcddfdmitrex_refsource_MISC
- github.com/frappe/frappe/commit/4772e3e7f72db43d48137af74fa77e5fce903223mitrex_refsource_MISC
- github.com/frappe/frappe/commit/57e527d933aeffaec0cd735838701792c848e3e7mitrex_refsource_MISC
- github.com/frappe/frappe/pull/38716mitrex_refsource_MISC
- github.com/frappe/frappe/pull/40044mitrex_refsource_MISC
- github.com/frappe/frappe/pull/40045mitrex_refsource_MISC
- github.com/frappe/frappe/releases/tag/v15.112.0mitrex_refsource_MISC
- github.com/frappe/frappe/releases/tag/v16.23.0mitrex_refsource_MISC
- github.com/frappe/frappe/security/advisories/GHSA-58w2-4cjg-hvp6mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.