GrandNode2 EUVD-2026-104526

Requires an authenticated user with access to GrandNode2's Excel product-import feature (admin/catalog import role - reflected by CVSS PR:H), which must be enabled and reachable. The concrete trigger is supplying a local filesystem path in the Picture1, Picture2, or Picture3 columns of the imported Excel; the vulnerable PrepareProductPictures/LoadPicture code read that path directly via File.ReadAllBytesAsync with no http(s)/host validation. Limiting factors: exploitation is gated by high privilege (not exploitable by anonymous/low-privilege users), and only affects versions up to 2.3.0 (fixed in 2.4.0). Impact is bounded to files readable by the application's service account and is most severe where imported pictures are subsequently served or viewable.

This is a medium-severity, privilege-gated path traversal (CWE-22) in GrandNode2's Excel product import, not a high-urgency internet-facing threat. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/PR:H/UI:N, score 5.1) confirms network reach but requires HIGH privileges (PR:H) - i.e. an authenticated administrator with catalog/import rights - which is the single most important mitigating signal and caps real-world risk. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The GitHub source evidence corroborates the mechanism: the pre-fix LoadPicture/PrepareProductPictures code called File.ReadAllBytesAsync on the attacker-supplied Picture path, allowing an importer to read arbitrary server-side files; the 2.4.0 fix removes local-path reads entirely and only downloads http(s) URLs from allowed hosts. One tension to note: VulDB/NVD rate confidentiality/integrity/availability impact as all LOW (VC:L/VI:L/VA:L), but arbitrary server-file disclosure is typically a HIGH confidentiality impact - verify impact scoring against your own file-exposure exposure (whether imported 'pictures' are publicly served). Net: a legitimate issue to patch, but the PR:H barrier makes it a routine-priority fix rather than an emergency, absent any exploitation or POC signal.

An authenticated administrator (or an attacker who has compromised an admin/import-capable account) uploads a crafted Excel product-import file and sets the Picture1/Picture2/Picture3 column to a local filesystem path such as a config or credentials file instead of an image. GrandNode2 reads that path via File.ReadAllBytes and ingests the file content as a product picture, disclosing arbitrary server-side file contents. No public POC is identified in the provided data; exploitation requires high privileges per CVSS PR:H.