Path Traversal Vulnerability in GrandNode Excel Import Feature
CVE-2026-112248

5.1MEDIUM

Key Information:

Vendor

Grandnode

Status
Grandnode2
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112248?

A vulnerability exists in the GrandNode platform affecting the Excel Import feature's ProductImportDataObject.PrepareProductPictures function, allowing for path traversal through manipulated arguments for Picture1, Picture2, and Picture3. This exploit can be initiated remotely, posing a significant security threat. Users are urged to upgrade to version 2.4.0 to mitigate this issue effectively.

Affected Version(s)

grandnode2 2.0

grandnode2 2.1

grandnode2 2.2

References

https://vuldb.com/vuln/422322
vdb-entrytechnical-description
https://vuldb.com/vuln/422322/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-112248
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

sonnt0393 (VulDB User)
VulDB CNA Team
.