File Path Validation Weakness in GRR Resource Management Application

CVE-2026-58257

What is CVE-2026-58257?

The GRR resource management application has a critical flaw in its database restoration feature, which fails to properly validate or enforce file paths. An attacker with administrator access could exploit this weakness by manipulating input parameters to read or delete arbitrary files on the server. This could lead to unauthorized disclosure of sensitive information and potential denial of service due to critical file deletions. The risks are significantly higher if the server operates with elevated privileges. This issue has been addressed in version 4.5.0.

References