CVE-2026-40258 Details
Description
The Gramps Web API is a Python REST API for the genealogical research software Gramps. Versions 1.6.0 through 3.11.0 have a path traversal vulnerability (Zip Slip) in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. Startig in version 3.11.1, ZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import.
A path traversal vulnerability, known as Zip Slip, has been identified in the Gramps Web API, specifically in versions 1.6.0 through 3.11.0. This vulnerability exists within the media archive import feature, where an authenticated user with owner-level privileges can upload a malicious ZIP file. The crafted ZIP file can contain directory-traversal filenames that allow the extraction of files to arbitrary locations on the server's local filesystem, outside the designated temporary extraction directory. This issue arises because the media importer does not properly validate ZIP entry names before extraction, enabling exploitation through the Python 'zipfile' module.
Users can upgrade to Gramps Web API version 3.11.1 or later, where this vulnerability has been patched. Instructions for downloading the latest version are available on the project's GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 17, 2026CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gramps-project/gramps-web-api/commit/3ed4342711e3ec849552df09b1fe2fbf2ca5c29a | [email protected] | Source CodeVendor |
| https://github.com/gramps-project/gramps-web-api/releases/tag/v3.11.1 | [email protected] | Release NotesVendor |
| https://github.com/gramps-project/gramps-web-api/security/advisories/GHSA-m5gr-86j6-99jp | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Gramps Web API | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 17, 2026 | New CVE Received | [email protected] |