CVE-2026-58257: GRR vulnerable to Arbitrary File Read and Deletion
GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server, causing sensitive file disclosure and denial of service through file deletion. The impact is amplified when the server runs with elevated privileges. The advisory reports this issue as fixed in version 4.5.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GRRto a version that resolves this vulnerability.Fixed in 4.5.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated GRR user with administrator privileges can exploit the database restoration feature by manipulating its file-path input. The issue is remotely reachable according to the supplied vector, but it does not affect users without administrator privileges.
Which deployments are affected?
GRR versions prior to 4.5.0 are affected. The advisory reports the issue as fixed in version 4.5.0.
What is the practical impact if exploited?
An administrator can read arbitrary server files, exposing sensitive information, or delete arbitrary server files, causing denial of service. The consequences are greater when GRR runs with elevated operating-system privileges.
What should be prioritized when patching is delayed?
Prioritize restricting administrator access to trusted users and limiting the privileges of the account running the GRR server. These measures reduce who can invoke the vulnerable restoration function and limit the files accessible to the server process.