A critical path traversal vulnerability in Gramps Web API allows authenticated users to execute arbitrary file writes on the underlying server filesystem.

The software fails to properly sanitize ZIP entry names during the media archive import process, leading to a Zip Slip vulnerability (CWE-22). This allows an authenticated user with owner-level privileges to traverse directories and write files outside the designated temporary directory.

Exploitation of this vulnerability could lead to full server compromise, as an attacker can overwrite critical system files, upload web shells, or modify configuration files to achieve remote code execution. With a CVSS score of 9.1, the ability to escape the application's sandbox poses a severe threat to the confidentiality, integrity, and availability of the host environment.

Immediate Action: Update the Gramps Web API to version 3.11.1 or later, which includes mandatory validation of ZIP entry paths against the resolved temporary directory.

Proactive Monitoring: Review file integrity logs and audit application-specific logs for unusual file creation events or attempts to access directories outside of expected storage locations.

Compensating Controls: Run the Gramps Web API service with the least privilege necessary, ideally within a containerized environment with a read-only root filesystem and restricted write access to specific mount points.

Public Exploit Available: Unknown

The risk posed by this path traversal flaw is substantial, particularly for multi-user installations of the Gramps Web API. Administrators should prioritize upgrading to version 3.11.1 immediately to ensure that path validation is correctly enforced, thereby preventing unauthorized file system modifications.