A critical path traversal vulnerability (Zip Slip) exists in the media archive import feature of gramps-webapi. Authenticated users with owner-level privileges can craft malicious ZIP files with directory-traversal filenames to write arbitrary files outside the intended extraction directory on the server. This can lead to cross-tree data corruption or overwriting of important files depending on the deployment configuration. The vulnerability affects versions from 1.6.0 up to but not including 3.11.1. A fix is available in version 3.11.1 that validates ZIP entry paths before extraction.