This vulnerability allows an attacker to execute arbitrary code on a server running the Frappe framework by submitting a malicious tar archive during the package import process. The flaw is caused by insufficient validation of tarfile members before extraction, resulting in a path traversal/unchecked extraction weakness (CWE‑22). When exploited the attacker gains the privileges of the web application, potentially leading to full system compromise.

The flaw affects any installation of the Frappe framework older than version 16.23.0 and 15.112.0. All users with those versions are potentially vulnerable until they upgrade.

The CVSS score of 8.6 indicates high severity, but the EPSS score of <1% shows a very low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack path is through the package import feature exposed via the web interface, so an attacker who can upload a crafted tar file can trigger malicious extraction and remote code execution.