CVE-2026-112248

MediumCVSS 4.7

Published: 19/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 20/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.59%

47th percentile - higher than 47% of all known CVEs

Summary

A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0, affecting the function ProductImportDataObject.PrepareProductPictures of the Excel Import component. Manipulation of the Picture1/Picture2/Picture3 arguments leads to path traversal, and the attack can be initiated remotely.

Risk Assessment

An attacker could exploit the flaw to gain unauthorized file access or write outside the intended directory, potentially compromising data confidentiality and integrity.

Recommendation

Upgrade grandnode2 to version 2.4.0, which contains the fix (patch identifier: 2abbaed232080ad74949c6f35581f0351e309972).

Other vulnerabilities in grandnode2

CVE-2026-112249Low
A vulnerability was detected in grandnode grandnode2 up to 2.3.0. It affects the Html.Raw function in the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml in the Product Description Handler component. Manipulation leads to cross-site scripting (XSS). The attack can be launched remotely. Upgrading to version 2.4.0-beta or 2.4.0 addresses the issue.

Original NVD description (English source)

A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0. This impacts the function ProductImportDataObject.PrepareProductPictures of the component Excel Import. The manipulation of the argument Picture1/Picture2/Picture3 leads to path traversal. The attack can be initiated remotely. Upgrading to version 2.4.0 will fix this issue. The identifier of the patch is 2abbaed232080ad74949c6f35581f0351e309972. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS