CVE-2026-55852

unknowncovered by 1 sourcefirst seen 2026-07-10

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Import because tarfile members were not sufficiently checked before extraction. This issue is fixed in versions 16.23.0 and 15.112.0.

⚡ Watch CVE-2026-55852

Get an email if CVE-2026-55852 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

unknownCVE-2026-55852: Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE w…nvd · 2026-07-10

External references

NVD record for CVE-2026-55852

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-55852 status](https://www.csirts.com/badge/CVE-2026-55852)](https://www.csirts.com/cve/CVE-2026-55852)