| शीर्षक | GrandNode grandnode2 <= 2.3.0 File Inclusion |
|---|
| विवरण | A Local File Inclusion (LFI) and Server-Side Request Forgery (SSRF) vulnerability was found in GrandNode grandnode2 up to 2.3.0. Affected is the product Excel import feature. The manipulation of the Picture1, Picture2 and Picture3 columns in the product import Excel file leads to path traversal and server-side request forgery, because these values are processed without any path or URL validation in two separate code paths.
An authenticated administrator is able to read arbitrary files from the server filesystem and to issue server-side HTTP requests to internal services. The file contents are stored in MongoDB and served publicly without authentication, which enables full exfiltration of sensitive configuration files including database credentials and application secrets.
The advisory was published on 2026-06-25 and rates the issue as Critical with CVSS 3.1 base score 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). No patched version is available at this time.
Note on CNA coordination: I am the reporter of this advisory, not a maintainer of the repository. On GitHub only maintainers and owners are able to request a CVE, so I was unable to request one myself. The maintainers have not responded and no CVE has been assigned in almost three months since publication. The same product has previously received CVE-2025-10216 through VulDB after the vendor did not respond. |
|---|
| स्रोत | ⚠️ https://github.com/grandnode/grandnode2/security/advisories/GHSA-8wj3-7vmm-69rj |
|---|
| उपयोगकर्ता | sonnt0393 (UID 101174) |
|---|
| सबमिशन | 17/09/2026 11:15 AM (1 महीना पहले) |
|---|
| संयम | 19/10/2026 02:48 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 422322 [grandnode grandnode2 तक 2.3.0 Excel Import ProductImportDataObject.PrepareProductPictures Picture1/Picture2/Picture3 निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|