CVE-2026-112248

MEDIUM 4.7

grandnode grandnode2 Excel Import ProductImportDataObject.PrepareProductPictures path traversal

CVSS Score

4.7

EPSS Score

0.0%

EPSS Percentile

0th

A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0. This impacts the function ProductImportDataObject.PrepareProductPictures of the component Excel Import. The manipulation of the argument Picture1/Picture2/Picture3 leads to path traversal. The attack can be initiated remotely. Upgrading to version 2.4.0 will fix this issue. The identifier of the patch is 2abbaed232080ad74949c6f35581f0351e309972. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.

CWE	CWE-22
Vendor	grandnode
Product	grandnode2
Published	Oct 19, 2026
Last Updated	Oct 19, 2026

Stay Ahead of the Next One

Get instant alerts for grandnode grandnode2

Be the first to know when new medium vulnerabilities affecting grandnode grandnode2 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

grandnode / grandnode2

2.0 2.1 2.2 2.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/422322 vuldb.com: https://vuldb.com/vuln/422322/cti vuldb.com: https://vuldb.com/cve/CVE-2026-112248 vuldb.com: https://vuldb.com/submit/986349 github.com: https://github.com/grandnode/grandnode2/security/advisories/GHSA-8wj3-7vmm-69rj github.com: https://github.com/grandnode/grandnode2/pull/862 github.com: https://github.com/grandnode/grandnode2/commit/2abbaed232080ad74949c6f35581f0351e309972 github.com: https://github.com/grandnode/grandnode2/releases/tag/2.4.0 github.com: https://github.com/grandnode/grandnode2/

Credits

🔍 sonnt0393 (VulDB User) VulDB CNA Team