Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. Details When importing media archives as ZIP file, `MediaImporter._check_disk_space_and_extract()` in `gramps_webapi/api/media_importer.py` called `zipfile.extractall()` without validating ZIP entry names. Python's `zipfile` module does not sanitize entry names containing `../` sequences, allowing extraction to paths outside the target directory. Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used: - **SQLite…
Recommended action: Upgrade to 3.11.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Users with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as GET /api/people/, GET /api/places/, GET /api/events/, and all other object list endpoints. This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected Versions All versions of Gramps Web API prior to the fix. Root Cause The vulnerability originates from the behaviour of PrivateProxyDb.iter() in Gramps core. The ProxyDbBase.iterobject() helper, which backs all iter() methods in PrivateProxyDb, correctly filters out top-level private objects but returns the remaining objects unsanitized — i.e. without stripping private sub-object references. In contrast, PrivateProxyDb.getfromhandle() does call the appropriate…
Recommended action: Upgrade to 3.11.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.