GRR CVE-2026-58257

Exploitation requires an authenticated GRR administrator account, because the flaw is in the admin-only database restoration feature (admin/controleurs/admin_open_mysql.php), which accepts a restore file without validating or constraining its path. The attacker supplies a manipulated path to read or delete an arbitrary server file; impact is amplified when the GRR server process runs under an elevated OS account with broad filesystem permissions. The principal limiting factors are the high-privilege requirement (administrator access) and the fact that reachable/deletable files depend on the privileges of the web server process; affected versions are GRR <= 4.4.2, with the issue fixed in 4.5.0.

This is a genuinely high-severity but access-gated flaw rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) is internally consistent with the description and the vendor advisory: network-reachable, low complexity, but requiring high privileges (PR:H) because the vulnerable database-restoration feature is an administrator-only function. The triple C:H/I:H/A:H reflects arbitrary file read (confidentiality), and arbitrary file deletion (integrity and availability/DoS). No EPSS score was supplied and the CVE is not on CISA KEV, so there is no signal of widespread or confirmed real-world exploitation; the vuln.today Decision label is 'this_week', consistent with a serious issue that is not an active-exploitation emergency. The required privilege level is the dominant mitigating factor - an attacker must already hold GRR administrator access - which substantially narrows the realistic threat to malicious or compromised admins, or to post-authentication privilege abuse, rather than anonymous internet attackers. No conflicting signals were found between the CVSS vector and the description; both agree exploitation is admin-gated.

An authenticated GRR administrator (or an attacker who has obtained admin credentials) opens the database restoration feature and submits a crafted file path instead of a legitimate SQL backup. Because the feature does not validate or constrain the path, the attacker reads sensitive server files (e.g. configuration or credential files) or deletes arbitrary files, causing denial of service - with impact amplified if the web server process runs with elevated OS privileges. No public exploit was identified at time of analysis; a vendor fix commit exists but it is the patch, not a weaponized PoC.