Frappe: TarSlip RCE in Package Import
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 0.5%
exploitation probability
0.5%top 63% of all CVEs
observed exploitation
nono source reports it
Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Import because tarfile members were not sufficiently checked before extraction. This issue is fixed in versions 16.23.0 and 15.112.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
frappe · frappeReferences
https://github.com/frappe/frappe/commit/3c75f13fd7d4441a880dd236450277dc37fcddfdhttps://github.com/frappe/frappe/commit/4772e3e7f72db43d48137af74fa77e5fce903223https://github.com/frappe/frappe/commit/57e527d933aeffaec0cd735838701792c848e3e7https://github.com/frappe/frappe/pull/38716https://github.com/frappe/frappe/pull/40044https://github.com/frappe/frappe/pull/40045https://github.com/frappe/frappe/releases/tag/v15.112.0https://github.com/frappe/frappe/releases/tag/v16.23.0https://github.com/frappe/frappe/security/advisories/GHSA-58w2-4cjg-hvp6