This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: Path Traversal in Media Archive Import. π₯ **Consequences**: Authenticated users can write arbitrary files to the server's local filesystem via malicious ZIPs. Critical integrity & confidentiality loss.
Q2Root Cause? (CWE/Flaw)
π‘οΈ **CWE-22**: Improper Limitation of a Pathname to a Restricted Directory. The flaw lies in how the API handles extracted paths from uploaded ZIP archives without sufficient sanitization.
Q3Who is affected? (Versions/Components)
π¦ **Affected**: Gramps Web API. π **Versions**: 1.6.0 through 3.11.0. π’ **Vendor**: gramps-project. If you are on v3.11.1 or later, you are safe.
Q4What can hackers do? (Privileges/Data)
π΅οΈ **Capabilities**: Write arbitrary files. π **Target**: Local server filesystem. π **Privilege**: Requires 'Owner' level authentication.β¦
π **Threshold**: Medium-High. π **Auth Required**: Yes, must be an authenticated user with 'Owner' privileges. π€ **Action**: Must upload a crafted ZIP file. Not remote unauthenticated.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π« **Public Exp?**: No PoCs listed in the data. π **Wild Exp**: Unlikely given the high privilege requirement (Owner level). Focus is on defense, not immediate panic.
Q7How to self-check? (Features/Scanning)
π **Check**: Review API version. π **Audit**: Check for unexpected files in media import directories. π **Logs**: Monitor for unusual ZIP upload patterns from owner accounts.
Q8Is it fixed officially? (Patch/Mitigation)
β **Fixed**: Yes! π **Patch**: Upgrade to **v3.11.1** or later. π **Ref**: See GitHub release v3.11.1 and commit 3ed4342 for the fix details.
Q9What if no patch? (Workaround)
π **Workaround**: Disable media archive import feature if possible. π« **Access Control**: Restrict 'Owner' privileges strictly.β¦
β οΈ **Priority**: High for Owners. π **Risk**: CVSS 8.6 (High). While auth is required, the impact (Full Control) is severe. Patch immediately if you have owner-level accounts active.