CVE-2026-112248 Details
Description
A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0. This impacts the function ProductImportDataObject.PrepareProductPictures of the component Excel Import. The manipulation of the argument Picture1/Picture2/Picture3 leads to path traversal. The attack can be initiated remotely. Upgrading to version 2.4.0 will fix this issue. The identifier of the patch is 2abbaed232080ad74949c6f35581f0351e309972. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.
A path traversal vulnerability has been identified in GrandNode version 2.3.0 and earlier. The issue resides in the 'ProductImportDataObject.PrepareProductPictures' function within the Excel Import component. The vulnerability allows for remote exploitation by manipulating the 'Picture1', 'Picture2', or 'Picture3' arguments, potentially leading to unauthorized access to the server's file system.
Users are advised to upgrade to GrandNode version 2.4.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/grandnode/grandnode2/ | [email protected] | Vendor |
| https://github.com/grandnode/grandnode2/commit/2abbaed232080ad74949c6f35581f0351e309972 | [email protected] | Source CodeVendor |
| https://github.com/grandnode/grandnode2/pull/862 | [email protected] | Issue TrackingVendor |
| https://github.com/grandnode/grandnode2/releases/tag/2.4.0 | [email protected] | Release NotesVendor |
| https://github.com/grandnode/grandnode2/security/advisories/GHSA-8wj3-7vmm-69rj | [email protected] | AdvisoryBroken LinkVendor |
| https://vuldb.com/cve/CVE-2026-112248 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/986349 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/422322 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/422322/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| grandnode grandnode2 | <= 2.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |