CVE-2026-40258 json
Gramps Web API has Zip Slip Path Traversal in Media Archive Import
published 6mo ago modified 13d ago also GHSA-m5gr-86j6-99jp , PYSEC-2026-346 , EUVD-2026-23541
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 34%
- public exploits
- 0
- none known
Summary
The Gramps Web API is a Python REST API for the genealogical research software Gramps. Versions 1.6.0 through 3.11.0 have a path traversal vulnerability (Zip Slip) in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. Startig in version 3.11.1, ZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import.
Patch / fix
- pypi gramps-webapi 3.11.1
Is CVE-2026-40258 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 6mo ago
Exploit prediction
0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| OSV | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | gramps-webapi | >=1.6.0, <3.11.1 |
3.11.1 |
Affected products
- gramps-project gramps-web-api
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/gramps-project/gramps-web-api/commit/3ed4342711e3ec849552df09b1fe2fbf2ca5c29a
web
-
github.com
/gramps-project/gramps-web-api/security/advisories/GHSA-m5gr-86j6-99jp
web
-
github.com
/gramps-project/gramps-web-api/releases/tag/v3.11.1
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-40258
advisory
-
github.com
/gramps-project/gramps-web-api
package
-
github.com
/pypa/advisory-database/tree/main/vulns/gramps-webapi/PYSEC-2026-346.yaml
web
-
pypi.org
/project/gramps-webapi
web, package
-
github.com
/advisories/GHSA-m5gr-86j6-99jp
advisory
Sources
- CVE List CVE-2026-40258
- GitHub Advisory GHSA-m5gr-86j6-99jp
- NVD CVE-2026-40258
- OSV PYSEC-2026-346
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.