CVE-2026-112248 in grandnode2
Summary
by MITRE • 10/19/2026
A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0. This impacts the function ProductImportDataObject.PrepareProductPictures of the component Excel Import. The manipulation of the argument Picture1/Picture2/Picture3 leads to path traversal. The attack can be initiated remotely. Upgrading to version 2.4.0 will fix this issue. The identifier of the patch is 2abbaed232080ad74949c6f35581f0351e309972. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in GrandNode, specifically affecting versions up through 2.3.0, represents a critical path traversal flaw within the Excel Import functionality. This security issue resides in the ProductImportDataObject.PrepareProductPictures function, which is responsible for processing image files during product data imports via spreadsheet uploads. The core technical defect stems from insufficient validation of user-supplied input arguments designated as Picture1, Picture2, and Picture3. When an attacker provides a maliciously crafted file path containing directory traversal sequences such as dot-dot-slash or encoded equivalents within these parameters, the application fails to sanitize this input before using it to construct local filesystem paths. This lack of proper canonicalization allows the system to resolve references outside the intended web root or upload directory, effectively bypassing access controls that are meant to restrict file operations to specific safe locations.
From an operational perspective, this vulnerability enables remote attackers to read arbitrary files from the underlying server operating system if they have the ability to submit Excel imports with manipulated picture paths. Depending on the configuration and permissions of the web application process, successful exploitation could lead to the disclosure of sensitive information such as database credentials stored in configuration files, internal source code, or other critical system artifacts. In more severe scenarios where write access is permitted through similar mechanisms, an attacker might overwrite existing files or create new executable scripts within accessible directories, potentially leading to remote code execution and full compromise of the host environment. The ability to initiate this attack remotely makes it particularly dangerous for e-commerce platforms that rely on bulk product imports from various sources without rigorous pre-validation.
This flaw aligns with Common Weakness Enumeration category CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes vulnerabilities where software does not properly neutralize special elements within file paths or filenames that could resolve to parent directories or other files outside the intended directory. Furthermore, in terms of tactical classification under MITRE ATT&CK, this vulnerability facilitates techniques associated with Collection and Exfiltration over Application Protocol, specifically leveraging legitimate administrative functions like data import tools to access restricted resources. The exploitation vector is classified as Remote (Network) with Low Complexity, indicating that a successful attack requires minimal effort from the adversary once network connectivity to the vulnerable service is established.
To mitigate this risk immediately, organizations running GrandNode versions prior to 2.4.0 should prioritize upgrading to version 2.4.0 or later, where the vendor has addressed the issue through patch identifier 2abbaed232080ad74949c6f35581f0351e309972. This update likely implements strict input validation and canonicalization checks to ensure that resolved file paths remain within designated safe directories. In the interim, before an upgrade can be performed, administrators should restrict access to the Excel import functionality by enforcing strong authentication mechanisms and limiting IP-based access if possible. Additionally, implementing a Web Application Firewall with rules capable of detecting path traversal patterns in POST request bodies containing uploaded files may provide a layer of defense against exploitation attempts while the system remains vulnerable.