Executive brief
Frappe, a web application framework, was vulnerable to a security flaw in its package import feature. An attacker with high-level permissions could upload a specially crafted archive file to execute arbitrary commands on the server. This could lead to a complete takeover of the system, data theft, or service disruption. Users should update to the latest versions to resolve this issue.
Technical details
A path traversal vulnerability (TarSlip) existed in the Package Import component of the Frappe framework. The root cause was insufficient validation of tarfile members before extraction, allowing an attacker to write files outside of the intended directory. By uploading a malicious archive containing path traversal sequences (e.g., ../) or unauthorized symlinks/hardlinks, a high-privileged attacker could achieve remote code execution (RCE). The fix introduces rigorous path safety checks, sanitizes package names via regex, blocks link extraction, and utilizes the Python 3.12+ data extraction filter. Patches are available in versions 15.112.0 and 16.23.0.
Affected products
- Frappe Technologies Frappe < 15.112.0, >= 16.0.0-beta.1, < 16.23.0
Timeline
- 2026-07-10: disclosed
- 2026-07-10: advisory
- 2026-06-16: patched: Fixes merged into version-15 and version-16 branches.
References
- https://github.com/frappe/frappe/commit/3c75f13fd7d4441a880dd236450277dc37fcddfd
- https://github.com/frappe/frappe/commit/4772e3e7f72db43d48137af74fa77e5fce903223
- https://github.com/frappe/frappe/commit/57e527d933aeffaec0cd735838701792c848e3e7
- https://github.com/frappe/frappe/pull/38716
- https://github.com/frappe/frappe/pull/40044
- https://github.com/frappe/frappe/pull/40045
- https://github.com/frappe/frappe/releases/tag/v15.112.0