A crafted ZIP file used during media archive import can contain filenames with directory‑traversal sequences such as "../../etc/passwd". When extracted, these entries resolve to paths outside the temporary extraction directory, permitting the attacker to create or overwrite any file accessible to the server process. This leads to compromise of confidentiality, integrity, or availability of the system, classified under CWE‑22.

The Gramps Web API project (gramps‑project:gramps‑web‑api) is affected in releases from 1.6.0 up to and including 3.11.0. Version 3.11.1 adds validation that rejects any ZIP entry whose resolved real path falls outside the designated temporary directory, aborting the import.

The vulnerability carries a CVSS score of 9.1, indicating very high risk. No EPSS data is available, and the issue is not included in CISA KEV. Exploitation requires an authenticated user with owner‑level privileges. The attacker would need to upload a malicious ZIP via the media archive import endpoint; upon extraction, the server writes files outside its intended directory, potentially gaining unprivileged or elevated system access if the server’s file‑system permissions allow it. The lack of a public exploit does not diminish the severity, as the path traversal flaw can be triggered without special conditions beyond ownership rights.