CVE-2026-58257 Details

A vulnerability in the GRR resource management application, prior to version 4.5.0, allows users with administrator privileges to exploit the database restoration feature. The issue arises because the application fails to properly validate file paths, enabling the manipulation of input to read or delete arbitrary files on the server. This flaw can lead to the unauthorized disclosure of sensitive files and a denial-of-service condition through file deletion, with the impact being more severe if the server operates with elevated privileges.

Users are advised to update GRR to version 4.5.0 or later, and to ensure that the 'personnalisation' directory is writable for customizations.