Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Gramps Web API is a Python REST API for the genealogical research software Gramps. Versions 1.6.0 through 3.11.0 have a path traversal vulnerability (Zip Slip) in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. Startig in version 3.11.1, ZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
CVE-2026-40258 The Gramps Web API is a Python REST API for the genealogical research software Gramps. Versions 1.6.0 through 3.11.0 have a path traversal vulnerability (Zip Slip) in… https://www.cve.org/CVERecord?id=CVE-2026-40258
Post summary
CVE-2026-40258 identifies a path traversal flaw (Zip Slip) in the Gramps Web API across versions 1.6.0 to 3.11.0.
🚨 CVE-2026-40258: Gramps Web API has Zip Slip Path... Zip Slip with owner privs = full filesystem write access - genealogy apps handling user archives are prime targets for ... https://zerodaysignal.com/vulnerability/CVE-2026-40258 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
A brief disclosure notes a Zip Slip path traversal in Gramps Web API, granting full filesystem write with owner privileges.
A Zip Slip path traversal flaw in `gramps-webapi` (CVE-2026-40258) could allow arbitrary file writes. Evaluate your `gramps-webapi` deployments for this #PathTraversal #grampswebapi #infosec vulnerability. https://www.pulsepatch.io/posts/cve-2026-40258-gramps-webapi-zip-slip-path-traversal
Post summary
A Zip Slip path traversal flaw in gramps-webapi (CVE-2026-40258) may allow arbitrary file writes; users are advised to assess and mitigate the vulnerability.