Path Traversal Vulnerability in Gramps Web API by Gramps

CVE-2026-40258

What is CVE-2026-40258?

The Gramps Web API, a Python REST API for genealogical research, suffers from a path traversal vulnerability in its media archive import feature. This vulnerability allows an authenticated user with owner-level privileges to exploit the system by crafting a malicious ZIP file containing directory-traversal filenames. Such manipulation could lead to writing arbitrary files outside the designated temporary extraction directory on the server's local filesystem, potentially compromising its security. Notably, starting from version 3.11.1, the API includes validation of ZIP entry names against the resolved real path, enhancing its protection against this type of attack.

References