CVE-2026-55852

Received Received - Intake

TarSlip RCE in Frappe Framework

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: GitHub, Inc.

Description

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Import because tarfile members were not sufficiently checked before extraction. This issue is fixed in versions 16.23.0 and 15.112.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-10

Last Modified

2026-07-10

Generated

2026-07-11

AI Q&A

2026-07-11

EPSS Evaluated

N/A

NVD

CVE-2026-55852

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	tar_slip	to 15.112.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability, known as TarSlip Remote Code Execution (RCE), affects the Frappe web application framework. It occurs because the tarfile members were not sufficiently checked before extraction during package import. This flaw allows an attacker to exploit the tarfile extraction process to execute arbitrary code remotely.

The issue was present in versions prior to 16.23.0 and 15.112.0 and has been fixed in these versions.

Impact Analysis

This vulnerability can have a severe impact as it allows remote code execution. An attacker exploiting this flaw could run arbitrary code on the affected system, potentially leading to unauthorized access, data theft, system compromise, or disruption of services.

Mitigation Strategies

To mitigate this vulnerability, update Frappe to version 16.23.0 or later, or 15.112.0 or later, where the TarSlip RCE issue in Package Import has been fixed.

Hi! I’m here to help you understand CVE-2026-55852. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70