CVE-2026-55852

HIGH

Frappe: TarSlip RCE in Package Import

Title source: cna
STIX 2.1

Description

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Import because tarfile members were not sufficiently checked before extraction. This issue is fixed in versions 16.23.0 and 15.112.0.

References (9)

Core 9
Core References
X_Refsource_Misc x_refsource_misc
https://github.com/frappe/frappe/releases/tag/v16.23.0
X_Refsource_Misc x_refsource_misc
https://github.com/frappe/frappe/pull/38716
X_Refsource_Misc x_refsource_misc
https://github.com/frappe/frappe/pull/40044
X_Refsource_Misc x_refsource_misc
https://github.com/frappe/frappe/pull/40045

Scores

CVSS v4 8.6
EPSS 0.0046
EPSS Percentile 37.3%
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-22
Status published
Products (2)
frappe/frappe < 15.112.0
frappe/frappe >= 16.0.0-beta.1, < 16.23.0
Published Jul 10, 2026
Tracked Since Jul 11, 2026