CVE Intelligence
Analysis AI-assisted

CVE-2026-40258: Gramps Web API Zip Slip Path Traversal in Media Archive Import

CVE-2026-40258 is a path traversal (Zip Slip) weakness in the media archive import feature of the Gramps Web API, affecting versions 1.6.0 through 3.11.0. According to the record, an authenticated user with owner-level privileges could use a crafted ZIP file to write files outside the temporary extraction directory. The description states that version 3.11.1 validates entry paths against the resolved temporary directory and aborts the import when an entry falls outside it.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-40258 affects the media archive import feature of the Gramps Web API, a Python REST API for the Gramps genealogy software. The weakness is classified as CWE-22 (Path Traversal), commonly called Zip Slip. The project's GitHub security advisory is GHSA-m5gr-86j6-99jp.

Impact

  • According to the record, an authenticated user with owner-level privileges can cause files to be written outside the intended temporary extraction directory on the server.
  • The record gives a CVSS 3.1 base score of 9.1 (Critical), with high confidentiality, integrity and availability impact and a changed scope. The vector also requires high privileges, which matches the owner-level requirement.
  • The practical consequences depend on deployment details that are not in the record.

Affected products and versions

  • Product: Gramps Web API (gramps-project).
  • Affected range stated in the description: versions 1.6.0 through 3.11.0.
  • Version 3.11.1 is described as the release that adds ZIP entry validation.
  • The structured affected and fixes fields in the record are empty, so the range should be confirmed against the advisory and release notes.

Exploitation status

The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.00611 with a percentile of 0.4788. EPSS estimates likelihood of exploitation and is not evidence that exploitation has occurred.

Remediation and mitigation

  • Upgrade Gramps Web API to version 3.11.1 or later, as described in the release page.
  • Until the upgrade is applied, limit the number of accounts with owner-level privileges and restrict the media archive import feature to trusted users.
  • Review the fix commit to confirm the change is present in your deployment.

Detection guidance

  • Review application logs for media archive import operations, especially those performed by owner accounts that do not normally import data.
  • Monitor the server for files created outside the application's temporary import directory, and for import errors raised by the path validation check.
  • Keep backups of media and data directories so that unexpected changes can be identified and reverted.

Limitations of the available information

  • The record does not include structured affected version ranges, fixed-version fields, or deployment context.
  • The record does not say whether public proof-of-concept code exists, so this is unknown.
  • The sources consulted do not describe real-world impact or incidents.

Frequently asked questions

Which Gramps Web API versions are affected by CVE-2026-40258?

The record states that versions 1.6.0 through 3.11.0 are affected. Version 3.11.1 is described as containing the fix.

Is CVE-2026-40258 known to be actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.