CVE-2026-40258: gramps-webapi: Zip Slip Path Traversal in Media Archive Import

Should you act?

Critical, preconditions apply

Severe if exploited, but exploitation needs conditions that may not apply to you. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
• EPSS 0.6%, percentile 49: FIRST’s model estimates a 0.6% chance of exploitation activity in the next 30 days, higher than 49% of all scored CVEs (low). EPSS is a probability, not a verdict.
• Needs an account (high (admin)). Exposure depends on who can log in.
• Only applies if your dependency tree includes gramps-webapi (PyPI) >= 1.6.0, <= 3.11.0, fixed in 3.11.1. Check your lockfile, including transitive dependencies.

What it is

The Gramps Web API is a Python REST API for the genealogical research software Gramps. Versions 1.6.0 through 3.11.0 have a path traversal vulnerability (Zip Slip) in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. Startig in version 3.11.1, ZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import.

From the GitHub advisory

Summary

A path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem.

Details

When importing media archives as ZIP file, MediaImporter.checkdiskspaceandextract() in grampswebapi/api/mediaimporter.py called zipfile.extractall() without validating ZIP entry names. Python's zipfile module does not sanitize entry names containing ../ sequences, allowing extraction to paths outside the target directory.

Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators.

Weakness type: CWE-22.

Product: gramps-webapi (PyPI) · Assigned by: GitHub_M · Published: 2026-04-17

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Privileges required: high (admin)
• User interaction: none
• Scope: changed (can affect other components)

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• FIRST EPSS (model of 2026-10-21): 0.61% probability of exploitation activity in the next 30 days; percentile 49.

Timeline

• 2026-04-10 — GitHub-reviewed advisory GHSA-m5gr-86j6-99jp published (critical)
• 2026-04-17 — CVE record published by GitHub_M
• 2026-04-20 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-m5gr-86j6-99jp github.com
2. CVE.org record CVE-2026-40258 cve.org
3. NVD entry CVE-2026-40258 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com
3. github.com github.com

Critical PyPI advisories · Today’s Security Digest