CVE-2026-40258

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40258", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-10T17:31:45.787Z", "datePublished": "2026-04-17T21:12:54.226Z", "dateUpdated": "2026-04-20T15:48:41.690Z"}, "containers": {"cna": {"title": "Gramps Web API has Zip Slip Path Traversal in Media Archive Import", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/gramps-project/gramps-web-api/security/advisories/GHSA-m5gr-86j6-99jp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gramps-project/gramps-web-api/security/advisories/GHSA-m5gr-86j6-99jp"}, {"name": "https://github.com/gramps-project/gramps-web-api/commit/3ed4342711e3ec849552df09b1fe2fbf2ca5c29a", "tags": ["x_refsource_MISC"], "url": "https://github.com/gramps-project/gramps-web-api/commit/3ed4342711e3ec849552df09b1fe2fbf2ca5c29a"}, {"name": "https://github.com/gramps-project/gramps-web-api/releases/tag/v3.11.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/gramps-project/gramps-web-api/releases/tag/v3.11.1"}], "affected": [{"vendor": "gramps-project", "product": "gramps-web-api", "versions": [{"version": ">= 1.6.0, < 3.11.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T21:12:54.226Z"}, "descriptions": [{"lang": "en", "value": "The Gramps Web API is a Python REST API for the genealogical research software Gramps. Versions 1.6.0 through 3.11.0 have a path traversal vulnerability (Zip Slip) in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. Startig in version 3.11.1, ZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import."}], "source": {"advisory": "GHSA-m5gr-86j6-99jp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-20T15:48:26.185722Z", "id": "CVE-2026-40258", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T15:48:41.690Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40258", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-20T15:48:26.185722Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T15:48:33.761Z"}}], "cna": {"title": "Gramps Web API has Zip Slip Path Traversal in Media Archive Import", "source": {"advisory": "GHSA-m5gr-86j6-99jp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "gramps-project", "product": "gramps-web-api", "versions": [{"status": "affected", "version": ">= 1.6.0, < 3.11.1"}]}], "references": [{"url": "https://github.com/gramps-project/gramps-web-api/security/advisories/GHSA-m5gr-86j6-99jp", "name": "https://github.com/gramps-project/gramps-web-api/security/advisories/GHSA-m5gr-86j6-99jp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/gramps-project/gramps-web-api/commit/3ed4342711e3ec849552df09b1fe2fbf2ca5c29a", "name": "https://github.com/gramps-project/gramps-web-api/commit/3ed4342711e3ec849552df09b1fe2fbf2ca5c29a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/gramps-project/gramps-web-api/releases/tag/v3.11.1", "name": "https://github.com/gramps-project/gramps-web-api/releases/tag/v3.11.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The Gramps Web API is a Python REST API for the genealogical research software Gramps. Versions 1.6.0 through 3.11.0 have a path traversal vulnerability (Zip Slip) in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. Startig in version 3.11.1, ZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T21:12:54.226Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40258", "state": "PUBLISHED", "dateUpdated": "2026-04-20T15:48:41.690Z", "dateReserved": "2026-04-10T17:31:45.787Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-17T21:12:54.226Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "gramps-web-api", "vendor": "gramps-project", "versions": [{"status": "affected", "version": ">= 1.6.0, < 3.11.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Gramps Web API is a Python REST API for the genealogical research software Gramps. Versions 1.6.0 through 3.11.0 have a path traversal vulnerability (Zip Slip) in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. Startig in version 3.11.1, ZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import."}, {"lang": "es", "value": "La API web de Gramps es una API REST de Python para el software de investigaci\u00f3n geneal\u00f3gica Gramps. Las versiones 1.6.0 a la 3.11.0 tienen una vulnerabilidad de salto de ruta (Zip Slip) en la funci\u00f3n de importaci\u00f3n de archivo multimedia. Un usuario autenticado con privilegios de nivel de propietario puede crear un archivo ZIP malicioso con nombres de archivo de recorrido de directorio para escribir archivos arbitrarios fuera del directorio de extracci\u00f3n temporal previsto en el sistema de archivos local del servidor. A partir de la versi\u00f3n 3.11.1, los nombres de entrada ZIP ahora se validan contra la ruta real resuelta del directorio temporal antes de la extracci\u00f3n. Cualquier entrada cuya ruta resuelta caiga fuera del directorio temporal genera un error y aborta la importaci\u00f3n."}], "id": "CVE-2026-40258", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40258", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T15:48:26.185722Z", "version": "2.0.3"}}]}, "published": "2026-04-17T22:16:32.067", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/gramps-project/gramps-web-api/commit/3ed4342711e3ec849552df09b1fe2fbf2ca5c29a"}, {"source": "security-advisories@github.com", "url": "https://github.com/gramps-project/gramps-web-api/releases/tag/v3.11.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/gramps-project/gramps-web-api/security/advisories/GHSA-m5gr-86j6-99jp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.6.0,3.11.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "gramps-web-api", "source": "cna", "vendor": "gramps-project"}, "product": "gramps-web-api", "vendor": "gramps-project"}], "analysis": {"en": {"generated_at": "2026-04-18T08:54:15.688716+00:00", "value": {"mitigation_remediation": ["Upgrade to Gramps Web API 3.11.1 or newer where ZIP entries are validated against the temporary directory\u2019s resolved real path", "If an upgrade is not immediately feasible, disable or restrict the media archive import functionality and ensure the temporary directory is confined to a non\u2011privileged sub\u2011filesystem or is mounted with restrictive permissions", "Review owner\u2011level accounts and revoke those unnecessary, reducing the number of users who can trigger the import operation"], "summary": {"action": "Immediate Patch", "impact": "Path Traversal via Zip Slip allowing arbitrary file writes"}, "threat_synthesis": {"affected_systems": "The Gramps Web API project (gramps\u2011project:gramps\u2011web\u2011api) is affected in releases from 1.6.0 up to and including 3.11.0. Version 3.11.1 adds validation that rejects any ZIP entry whose resolved real path falls outside the designated temporary directory, aborting the import.", "description_and_impact": "A crafted ZIP file used during media archive import can contain filenames with directory\u2011traversal sequences such as \"../../etc/passwd\". When extracted, these entries resolve to paths outside the temporary extraction directory, permitting the attacker to create or overwrite any file accessible to the server process. This leads to compromise of confidentiality, integrity, or availability of the system, classified under CWE\u201122.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 9.1, indicating very high risk. No EPSS data is available, and the issue is not included in CISA KEV. Exploitation requires an authenticated user with owner\u2011level privileges. The attacker would need to upload a malicious ZIP via the media archive import endpoint; upon extraction, the server writes files outside its intended directory, potentially gaining unprivileged or elevated system access if the server\u2019s file\u2011system permissions allow it. The lack of a public exploit does not diminish the severity, as the path traversal flaw can be triggered without special conditions beyond ownership rights."}}}}, "created": "2026-04-18T09:00:05.897161+00:00", "updated": "2026-04-20T14:59:31.527820+00:00", "vendors": ["gramps-project", "gramps-project$PRODUCT$gramps-web-api"]}