CVE-2026-112248 json
grandnode grandnode2 Excel Import ProductImportDataObject.PrepareProductPictures path traversal
published 2026-10-19 20 d ago modified 2026-10-20 20 d ago also EUVD-2026-104526
- cvss
- 4.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 48%
- public exploits
- 0
- none known
Summary
A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0. This impacts the function ProductImportDataObject.PrepareProductPictures of the component Excel Import. The manipulation of the argument Picture1/Picture2/Picture3 leads to path traversal. The attack can be initiated remotely. Upgrading to version 2.4.0 will fix this issue. The identifier of the patch is 2abbaed232080ad74949c6f35581f0351e309972. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.
Patch / fix
- grandnode grandnode2 2.4.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 20 d ago
Exploit prediction
0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X |
| CNA | 3.1 | 4.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C |
| CNA | 3.0 | 4.7 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C |
| CNA | 2.0 | 5.8 | AV:N/AC:L/Au:M/C:P/I:P/A:P/E:ND/RL:OF/RC:C |
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 4.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 5.8 | AV:N/AC:L/Au:M/C:P/I:P/A:P |
Affected products
- grandnode grandnode2
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/grandnode/grandnode2/pull/862
issue-tracking, patch
-
github.com
/grandnode/grandnode2/commit/2abbaed232080ad74949c6f35581f0351e309972
patch
-
github.com
/grandnode/grandnode2/releases/tag/2.4.0
patch
-
vuldb.com
/vuln/422322
vdb-entry, technical-description
-
vuldb.com
/vuln/422322/cti
signature, permissions-required
-
vuldb.com
/cve/CVE-2026-112248
third-party-advisory
-
vuldb.com
/submit/986349
third-party-advisory
-
github.com
/grandnode/grandnode2/security/advisories/GHSA-8wj3-7vmm-69rj
broken-link
-
github.com
/grandnode/grandnode2/
product
Sources
- CVE List CVE-2026-112248
- NVD CVE-2026-112248
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.