CVE-2026-55852: Frappe Framework TarSlip RCE Vulnerability

CVE-2026-55852 Overview

CVE-2026-55852 is a path traversal vulnerability [CWE-22] in Frappe, a full-stack web application framework used by ERPNext and other business applications. The flaw resides in the Package Import feature, where tarfile members were extracted without sufficient validation of their destination paths. An authenticated attacker with high privileges can craft a malicious tar archive containing entries with traversal sequences or absolute paths, achieving remote code execution on the server. The vulnerability is fixed in Frappe versions 16.23.0 and 15.112.0.

Critical Impact
Successful exploitation grants attackers arbitrary file write outside the intended extraction directory, leading to remote code execution and full compromise of the Frappe application host.

Affected Products

Frappe framework versions prior to 15.112.0 (v15 branch)
Frappe framework versions prior to 16.23.0 (v16 branch)
Applications built on vulnerable Frappe releases, including ERPNext deployments using the Package Import doctype

Discovery Timeline

2026-07-10 - CVE-2026-55852 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-55852

Vulnerability Analysis

The vulnerability is a classic TarSlip, a tar-based variant of the Zip Slip class of path traversal issues. Frappe's package_import doctype accepts a tar archive uploaded by a privileged user and extracts its contents to a server-side directory. Before the fix, the extraction routine iterated over tarfile members and wrote them to disk without validating that resolved paths remained within the intended extraction root. Archive members can specify relative traversal segments such as ../../ or absolute paths, allowing files to be written anywhere the Frappe process can access.

Because Frappe serves Python applications, writing to arbitrary paths quickly escalates to code execution. An attacker can overwrite hooks, application modules, cron entries, or shell startup files, which the framework or operating system will later execute.

Root Cause

The root cause is missing validation of tar member names before extraction. The pre-patch code used subprocess to invoke a shell-level extraction without a Python-level allowlist. The fix removes the shell invocation and replaces it with tarfile handling combined with check_path_safety from frappe.core.doctype.file.utils, which rejects members that resolve outside the target directory.

Attack Vector

Exploitation requires network access to the Frappe web interface and an account with permission to submit a Package Import. The attacker uploads a crafted .tar file whose members reference paths outside the extraction directory. On extraction, files are written to attacker-chosen locations on the server filesystem, enabling remote code execution when the written file is invoked by Frappe workers or the operating system.

python

# Security patch imports in frappe/core/doctype/package_import/package_import.py
import json
import os
-import subprocess
+import re
+import tarfile

import frappe
+from frappe.core.doctype.file.utils import check_path_safety
from frappe.desk.form.load import get_attachments
from frappe.model.document import Document
from frappe.model.sync import get_doc_files

Source: GitHub Commit 57e527d. The patch removes the subprocess-based extraction path and introduces tarfile with check_path_safety to validate each member before it is written to disk.

Detection Methods for CVE-2026-55852

Indicators of Compromise

Package Import submissions containing tar archives with members whose normalized paths resolve outside the expected extraction directory.
Unexpected file writes under Frappe application directories, site config paths, or system locations such as /etc/cron.d/ shortly after a Package Import event.
New or modified Python files in apps/, sites/, or hooks directories that do not correspond to a legitimate deployment.
Frappe process spawning shells or interpreters immediately following a Package Import operation.

Detection Strategies

Audit the Package Import doctype log for submissions and correlate each event with filesystem changes on the Frappe host.
Inspect uploaded tar archives with tar -tvf archive.tar and flag any entry containing .., absolute paths, or symlinks pointing outside the archive root.
Enable filesystem integrity monitoring on Frappe application, hooks, and site configuration directories to alert on out-of-band writes.

Monitoring Recommendations

Forward Frappe application and Nginx access logs to a centralized log platform and alert on POST requests to Package Import endpoints from unexpected users or IPs.
Monitor process creation events on Frappe hosts for child processes of the gunicorn or frappe worker that execute shells, python, or package managers.
Track privileged Frappe account activity, including creation of new System Manager users and use of Package Import in production environments.

How to Mitigate CVE-2026-55852

Immediate Actions Required

Upgrade Frappe to version 15.112.0 on the v15 branch or 16.23.0 on the v16 branch as the primary remediation.
Restrict the System Manager role and any role granted write access to the Package Import doctype to a minimal set of trusted administrators.
Review recent Package Import submissions and audit filesystem changes on Frappe hosts for signs of prior exploitation.

Patch Information

The vendor released fixes in Frappe v15.112.0 and Frappe v16.23.0. The security advisory is tracked as GHSA-58w2-4cjg-hvp6, with fixes delivered through pull request #38716, pull request #40044, and pull request #40045.

Workarounds

If patching is not immediately possible, disable the Package Import feature by removing role permissions on the Package Import doctype.
Block ingress uploads of tar archives at the reverse proxy for endpoints that lead to Package Import until the framework is upgraded.
Run Frappe workers under a dedicated unprivileged user with strict filesystem permissions so that writes outside the site directory are denied by the operating system.

bash

# Verify installed Frappe version and upgrade using bench
bench version --format plain | grep frappe
bench update --patch --no-backup=false
bench --site all migrate
# Confirm the upgraded version meets the fixed release
bench version --format plain | grep frappe