Live › vulnerability › CVE-2026-58257
Go to dashboardGRR, a resource reservation application, fails to validate file paths in its database restore feature. An administrator can read or delete arbitrary files on the server, leaking sensitive files and causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 23:29 UTC. All times on this page are UTC.
Teams running GRR before 4.5.0 where administrator accounts exist. Exposure is greater when the server runs with elevated privileges. Installations already on or later are not affected by this issue.
4.5.0No product ranges from the sources yet.
4.5.0 are listed as affected.4.5.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server, causing sensitive file disclosure and denial of service through file deletion. The impact is amplified when the server runs with elevated privileges. The advisory reports this issue as fixed in version 4.5.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-58257")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.