VYPR
Get started
← All advisories
Critical severity9.1NVD Advisory· Published Apr 17, 2026· Updated Apr 29, 2026

CVE-2026-40258

CVE-2026-40258

Description

The Gramps Web API is a Python REST API for the genealogical research software Gramps. Versions 1.6.0 through 3.11.0 have a path traversal vulnerability (Zip Slip) in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. Startig in version 3.11.1, ZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
gramps-webapiPyPI
>= 1.6.0, < 3.11.13.11.1

Affected products

1

Patches

1
3ed4342711e3

Media importer: prevent writes outside tmp

https://github.com/gramps-project/gramps-web-apiDavid StraubApr 10, 2026via ghsa
commit
1 file changed · +5 −0
  • gramps_webapi/api/media_importer.py+5 −0 modified
    @@ -102,6 +102,11 @@ def _check_disk_space_and_extract(self) -> str:
                 raise ValueError("Not enough free space on disk")
 
             temp_dir = tempfile.mkdtemp()
+            temp_dir_real = os.path.realpath(temp_dir)
+            for member in zip_file.namelist():
+                member_path = os.path.realpath(os.path.join(temp_dir_real, member))
+                if not member_path.startswith(temp_dir_real + os.sep):
+                    raise ValueError(f"Zip Slip path traversal detected: {member}")
             zip_file.extractall(temp_dir)
 
         return temp_dir

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.