CVE-2026-55852
Frappe: TarSlip RCE in Package Import
CVSS Score
0.0
EPSS Score
0.5%
EPSS Percentile
37th
Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Import because tarfile members were not sufficiently checked before extraction. This issue is fixed in versions 16.23.0 and 15.112.0.
| CWE | CWE-22 |
| Vendor | frappe |
| Product | frappe |
| Published | Jul 10, 2026 |
| Last Updated | Jul 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for frappe frappe
Be the first to know when new unknown vulnerabilities affecting frappe frappe are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
frappe / frappe
< 15.112.0 >= 16.0.0-beta.1, < 16.23.0
References
github.com: https://github.com/frappe/frappe/security/advisories/GHSA-58w2-4cjg-hvp6 github.com: https://github.com/frappe/frappe/pull/38716 github.com: https://github.com/frappe/frappe/pull/40044 github.com: https://github.com/frappe/frappe/pull/40045 github.com: https://github.com/frappe/frappe/commit/3c75f13fd7d4441a880dd236450277dc37fcddfd github.com: https://github.com/frappe/frappe/commit/4772e3e7f72db43d48137af74fa77e5fce903223 github.com: https://github.com/frappe/frappe/commit/57e527d933aeffaec0cd735838701792c848e3e7 github.com: https://github.com/frappe/frappe/releases/tag/v15.112.0 github.com: https://github.com/frappe/frappe/releases/tag/v16.23.0