CVE Feed

    Dashboard / CVE / CVE-2026-112248

    CVE-2026-112248

    A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0. This impacts the function ProductImportDataObject.PrepareProductPictures of the component Excel Import. The manipulation of the argument Picture1/Picture2/Picture3 leads to path traversal. The attack can be initiated remotely. Upgrading to version 2.4.0 will fix this issue. The identifier of the patch is 2abbaed232080ad74949c6f35581f0351e309972. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.

    Published:Oct 19, 2026
    Last Modified:Oct 20, 2026
    EPS:Oct 19, 2026
    EPSS Score:0.0059
    CVSS Score:4.7

    Affected Products

    Vendor
    Grandnode
    Product
    Grandnode
    Vendor
    Grandnode
    Product
    Grandnode2

    Exploits

    No exploit reference

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High