{"id":"CVE-2026-58257","kind":"vulnerability","aliases":["CVE-2026-58257"],"related":[],"title":"GRR: database restore path traversal reads and deletes server files","description":"GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server, causing sensitive file disclosure and denial of service through file deletion. The impact is amplified when the server runs with elevated privileges. The advisory reports this issue as fixed in version 4.5.0.","summary":"GRR, a resource reservation application, fails to validate file paths in its database restore feature. An administrator can read or delete arbitrary files on the server, leaking sensitive files and causing denial of service.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["grr","package","self-hosted"],"not_affected_if":["fixed-version","no-admin-users"],"how_to_check":"- Check the installed GRR version; versions before `4.5.0` are listed as affected.\n- Confirm whether untrusted or lower-trust users hold administrator roles in GRR.","fix":"- Upgrade GRR to `4.5.0` or later.\n- Limit administrator accounts to trusted staff until the upgrade is applied.\n- Run the GRR service with minimal filesystem privileges.","status":"open","published_at":"2026-10-27T23:17:06+00:00","first_seen_at":"2026-10-27T23:29:44+00:00","triaged_at":"2026-10-27T23:31:18+00:00","updated_at":"2026-10-27T23:31:18+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T23:31:18Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GRR to `4.5.0` or later.\n- Limit administrator accounts to trusted staff until the upgrade is applied.\n- Run the GRR service with minimal filesystem privileges.","reach":"network","title":"GRR: database restore path traversal reads and deletes server files","impact":"high","summary":"GRR, a resource reservation application, fails to validate file paths in its database restore feature. An administrator can read or delete arbitrary files on the server, leaking sensitive files and causing denial of service.","category":"package","nicknames":[],"who_cares":["grr","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Arbitrary server files read or deleted by an administrator account","analyst_note":"Check the GRR advisory for the exact affected version range and whether the restore feature has a default configuration that exposes it.","how_to_check":"- Check the installed GRR version; versions before `4.5.0` are listed as affected.\n- Confirm whether untrusted or lower-trust users hold administrator roles in GRR.","needs_analyst":true,"not_affected_if":["fixed-version","no-admin-users"],"who_is_affected":"Teams running GRR before `4.5.0` where administrator accounts exist. Exposure is greater when the server runs with elevated privileges. Installations already on `4.5.0` or later are not affected by this issue.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00059,"input_tokens":3343,"output_tokens":512,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-58257':13A,16A '4.5.0':72C,133C 'administr':38B,87C 'advisori':68C,125C 'advisory-report':67C 'amplifi':116C 'applic':26B,63C 'arbitrari':43B,97C 'caus':52B,102C 'cve':11A,14A 'databas':2A,34B,74C 'delet':8A,42B,96C,112C 'denial':53B,107C 'disclosur':105C 'elev':122C 'enforc':79C 'fail':27B,77C 'featur':36B,76C 'file':10A,30B,44B,50B,82C,98C,104C,111C 'fix':70C,130C 'grr':1A,17B,22B,56C 'host':21B 'impact':114C 'input':92C 'issu':128C 'leak':48B 'manag':60C 'manipul':90C 'packag':18B 'path':4A,31B,83C 'prior':64C 'privileg':88C,123C 'read':6A,40B,94C 'report':69C,126C 'reserv':25B,62C 'resourc':24B,59C 'restor':3A,35B,75C 'run':120C 'self':20B 'self-host':19B 'sensit':49B,103C 'server':9A,47B,101C,119C 'servic':55B,109C 'travers':5A 'user':85C 'valid':29B,81C 'version':71C,132C","nicknames":[],"mitigations":[],"who_affected":"Teams running GRR before `4.5.0` where administrator accounts exist. Exposure is greater when the server runs with elevated privileges. Installations already on `4.5.0` or later are not affected by this issue.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T23:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58257","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58257","severity":null,"published_at":"2026-10-27T23:17:06+00:00","modified_at":"2026-10-27T23:17:06+00:00","first_seen_at":"2026-10-27T23:29:44+00:00","fetched_at":"2026-10-27T23:29:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}