CVE-2026-112248
4.7 MEDIUMpublic exploit availablePublished 2026-10-19 · Updated 2026-10-19
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0. This impacts the function ProductImportDataObject.PrepareProductPictures of the component Excel Import. The manipulation of the argument Picture1/Picture2/Picture3 leads to path traversal. The attack can be initiated remotely. Upgrading to version 2.4.0 will fix this issue. The identifier of the patch is 2abbaed232080ad74949c6f35581f0351e309972. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-22
Public exploit & PoC references
- https://github.com/grandnode/grandnode2/
- https://github.com/grandnode/grandnode2/commit/2abbaed232080ad74949c6f35581f0351e309972
- https://github.com/grandnode/grandnode2/pull/862
- https://github.com/grandnode/grandnode2/releases/tag/2.4.0
- https://github.com/grandnode/grandnode2/security/advisories/GHSA-8wj3-7vmm-69rj
All references
- https://github.com/grandnode/grandnode2/
- https://github.com/grandnode/grandnode2/commit/2abbaed232080ad74949c6f35581f0351e309972
- https://github.com/grandnode/grandnode2/pull/862
- https://github.com/grandnode/grandnode2/releases/tag/2.4.0
- https://github.com/grandnode/grandnode2/security/advisories/GHSA-8wj3-7vmm-69rj
- https://vuldb.com/cve/CVE-2026-112248
- https://vuldb.com/submit/986349
- https://vuldb.com/vuln/422322
- https://vuldb.com/vuln/422322/cti
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2014-125130PoC
- HIGHCVE-2017-20284
- HIGHCVE-2021-48011PoC
- HIGHCVE-2023-54403PoC
- MEDIUMCVE-2024-58386PoC
- HIGHCVE-2024-58387PoC
- HIGHCVE-2024-58388PoC
- MEDIUMCVE-2025-1280
Related by shared AI tags and CWE weakness class. Browse the full archive.