CVE-2026-112248
grandnode grandnode2 Excel Import ProductImportDataObject.PrepareProductPictures path traversal
- State
- Published
- Severity
- 5.1 Medium
- Published
- Oct 19, 2026
- Updated
- Oct 20, 2026
- Reserved
- Oct 19, 2026
Description
A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0. This impacts the function ProductImportDataObject.PrepareProductPictures of the component Excel Import. The manipulation of the argument Picture1/Picture2/Picture3 leads to path traversal. The attack can be initiated remotely. Upgrading to version 2.4.0 will fix this issue. The identifier of the patch is 2abbaed232080ad74949c6f35581f0351e309972. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X | VulDB |
| 3.1 | 4.7 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C | VulDB |
| 3.0 | 4.7 Medium | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C | VulDB |
| 2.0 | 5.8 Medium | AV:N/AC:L/Au:M/C:P/I:P/A:P/E:ND/RL:OF/RC:C | VulDB |
Weaknesses
- CWE-22 Path Traversal
Affected Products
| Product | Versions |
|---|---|
grandnode2grandnode |
|
References
- VDB-422322 | grandnode grandnode2 Excel Import ProductImportDataObject.PrepareProductPictures path traversalvdb-entrytechnical-description
- VDB-422322 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-112248 | CVE Analysis and Reportthird-party-advisory
- Submit #986349 | GrandNode grandnode2 <= 2.3.0 File Inclusionthird-party-advisory
- https://github.com/grandnode/grandnode2/security/advisories/GHSA-8wj3-7vmm-69rjbroken-link
- https://github.com/grandnode/grandnode2/pull/862issue-trackingpatch
- https://github.com/grandnode/grandnode2/commit/2abbaed232080ad74949c6f35581f0351e309972patch
- https://github.com/grandnode/grandnode2/releases/tag/2.4.0patch
- https://github.com/grandnode/grandnode2/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.