gramps-webapi
A RESTful web API for Gramps - backend of Gramps Web
View on Github
Activity
- Latest release
- 3d ago
- Total releases
- 98
- Cadence
- ~8 days
- Last 12 months
- 29
Reach
- Stars
- 220
Details
- License
- unknown
- First release
- Jul 03, 2021
| Version | Released | |
|---|---|---|
3.22.0
minor
| ||
3.21.1
patch
| ||
3.21.0
minor
| ||
3.20.1
patch
| ||
3.20.0
minor
| ||
3.19.0
minor
| ||
3.18.0
minor
| ||
3.17.0
minor
| ||
3.16.0
minor
| ||
3.15.0
minor
| ||
3.14.1
patch
| ||
3.14.0
minor
| ||
3.13.1
patch
| ||
3.13.0
minor
| ||
3.12.2
patch
| ||
3.12.1
patch
| ||
3.12.0
minor
| ||
3.11.1
patch
| ||
3.11.0
minor
1 CVE
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
3.10.0
minor
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
3.9.1
patch
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
3.9.0
minor
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
3.8.0
minor
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
3.7.1
patch
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
3.7.0
minor
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
3.6.0
minor
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
3.5.0
minor
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
3.4.1
patch
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
3.4.0
minor
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
3.3.0
minor
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
3.2.0
minor
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
3.1.0
minor
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
3.0.2
patch
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
3.0.1
patch
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
3.0.0
major
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
2.9.2
patch
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
2.9.1
patch
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
2.9.0
minor
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
2.8.2
patch
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
2.8.1
patch
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
2.8.0
minor
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
2.7.0
minor
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
2.6.0
minor
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
2.5.3
patch
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
2.5.2
patch
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
2.5.1
patch
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
2.5.0
minor
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
2.4.3
patch
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
2.4.2
patch
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev | ||
2.4.1
patch
2 CVEs
CVE-2026-40258
PYSEC-2026-346
GHSA-m5gr-86j6-99jp
Jun 29, 2026
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
9.1
/ 10
Critical
Network
Low
High
None
Changed
High
High
High
SummaryA path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. DetailsWhen importing media archives as ZIP file, Only users with owner permission can upload media ZIP archives, so the biggest risk is for multi-tree deployments, where tree owners are distinct from server administrators. For multi-tree deployments, the impact depends on deployment configuration. Assuming the standard docker-based deployment is used:
FixZIP entry names are now validated against the resolved real path of the temporary directory before extraction. Any entry whose resolved path falls outside the temporary directory raises an error and aborts the import. Affected versions
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
+ 28 more Show less
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.11.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.1
References
Updated Jul 13, 2026 · Source: OSV.dev
GHSA-9gjv-jvm7-vv2v
Apr 09, 2026
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
Network
Low
None
None
SummaryUsers with the Guest role could receive private sub-object data (e.g. private alternate names, private addresses, private note/citation/media handles) through list API endpoints such as This does not expose objects (people, places, events, …) that are themselves marked private. Top-level private objects are correctly excluded from all responses. Only sub-object data attached to otherwise-public objects is affected. Affected VersionsAll versions of Gramps Web API prior to the fix. Root CauseThe vulnerability originates from the behaviour of Gramps Web API's The same issue affects Gramps desktop features that consume Conditions RequiredThis issue only affects trees in which sub-objects have been explicitly marked private in Gramps desktop. The Gramps Web frontend UI does not expose controls for setting the private flag on sub-objects (alternate names, addresses, notes, citations, media references, event references, etc.). In practice, such flags are set in Gramps desktop and then synced or imported into Gramps Web. ImpactWhen the conditions above are met, a user with the Guest role querying any list endpoint receives:
Fix
Affected versions
0.1
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
+ 67 more Show less
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
1.0.0
1.1.0
1.1.1
1.1.10
1.1.11
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0
2.9.1
2.9.2
3.0.0
3.0.1
3.0.2
3.1.0
3.10.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
Fixed in
3.11.0
References Updated Apr 09, 2026 · Source: OSV.dev |