CVE-2026-55852
Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Import because tarfile members were not sufficiently checked before extraction. This issue is fixed in versions 16.23.0 and 15.112.0.
Debilidad
Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Import because tarfile members were not sufficiently checked before extraction. This issue is fixed in versions 16.23.0 and 15.112.0.
Referencias
- https://github.com/frappe/frappe/commit/3c75f13fd7d4441a880dd236450277dc37fcddfd
- https://github.com/frappe/frappe/commit/4772e3e7f72db43d48137af74fa77e5fce903223
- https://github.com/frappe/frappe/commit/57e527d933aeffaec0cd735838701792c848e3e7
- https://github.com/frappe/frappe/pull/38716
- https://github.com/frappe/frappe/pull/40044
- https://github.com/frappe/frappe/pull/40045
Encuentra el fallo antes que un atacante.
Inicia sesión con GitHub y ejecuta tu primera auditoría en menos de un minuto. El plan gratuito no requiere tarjeta de crédito.