| Titre | GrandNode grandnode2 <= 2.3.0 File Inclusion |
|---|
| Description | A Local File Inclusion (LFI) and Server-Side Request Forgery (SSRF) vulnerability was found in GrandNode grandnode2 up to 2.3.0. Affected is the product Excel import feature. The manipulation of the Picture1, Picture2 and Picture3 columns in the product import Excel file leads to path traversal and server-side request forgery, because these values are processed without any path or URL validation in two separate code paths.
An authenticated administrator is able to read arbitrary files from the server filesystem and to issue server-side HTTP requests to internal services. The file contents are stored in MongoDB and served publicly without authentication, which enables full exfiltration of sensitive configuration files including database credentials and application secrets.
The advisory was published on 2026-06-25 and rates the issue as Critical with CVSS 3.1 base score 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). No patched version is available at this time.
Note on CNA coordination: I am the reporter of this advisory, not a maintainer of the repository. On GitHub only maintainers and owners are able to request a CVE, so I was unable to request one myself. The maintainers have not responded and no CVE has been assigned in almost three months since publication. The same product has previously received CVE-2025-10216 through VulDB after the vendor did not respond. |
|---|
| La source | ⚠️ https://github.com/grandnode/grandnode2/security/advisories/GHSA-8wj3-7vmm-69rj |
|---|
| Utilisateur | sonnt0393 (UID 101174) |
|---|
| Soumission | 17/09/2026 11:15 (il y a 1 mois) |
|---|
| Modérer | 19/10/2026 14:48 (1 month later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 422322 [grandnode grandnode2 jusqu’à 2.3.0 Excel Import ProductImportDataObject.PrepareProductPictures Picture1/Picture2/Picture3 directory traversal] |
|---|
| Points | 20 |
|---|