Path Traversal in Gramps-Project Gramps-Web-Api
CVE-2026-40258
The Gramps Web API is a Python REST API for the genealogical research software Gramps. Versions 1.6.0 through 3.11.0 have a path traversal vulnerability (Zip Slip) in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. Startig in version 3.11.1, ZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.004 (32.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Gramps-project Gramps-web-api — versions >= 1.6.0, < 3.11.1
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-40258?
- CVE-2026-40258 is a critical-severity vulnerability in Gramps-Project Gramps-Web-Api, classified under Path Traversal. CVSS score: 9.1/10. Published 2026-04-17.
- How severe is CVE-2026-40258?
- Critical severity. CVSS v3 base score is 9.1 out of 10.