CVE-2026-40258

{
  "id": "CVE-2026-40258",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-17T22:16:32.067",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Gramps Web API is a Python REST API for the genealogical research software Gramps. Versions 1.6.0 through 3.11.0 have a path traversal vulnerability (Zip Slip) in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. Startig in version 3.11.1, ZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import."
    },
    {
      "lang": "es",
      "value": "La API web de Gramps es una API REST de Python para el software de investigación genealógica Gramps. Las versiones 1.6.0 a la 3.11.0 tienen una vulnerabilidad de salto de ruta (Zip Slip) en la función de importación de archivo multimedia. Un usuario autenticado con privilegios de nivel de propietario puede crear un archivo ZIP malicioso con nombres de archivo de recorrido de directorio para escribir archivos arbitrarios fuera del directorio de extracción temporal previsto en el sistema de archivos local del servidor. A partir de la versión 3.11.1, los nombres de entrada ZIP ahora se validan contra la ruta real resuelta del directorio temporal antes de la extracción. Cualquier entrada cuya ruta resuelta caiga fuera del directorio temporal genera un error y aborta la importación."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "gramps-project",
          "product": "gramps-web-api",
          "versions": [
            {
              "version": ">= 1.6.0, < 3.11.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-20T15:48:26.185722Z",
          "id": "CVE-2026-40258",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/gramps-project/gramps-web-api/commit/3ed4342711e3ec849552df09b1fe2fbf2ca5c29a",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/gramps-project/gramps-web-api/releases/tag/v3.11.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/gramps-project/gramps-web-api/security/advisories/GHSA-m5gr-86j6-99jp",
      "source": "[email protected]"
    }
  ]
}