A path traversal flaw exists in grandnode2’s ProductImportDataObject.PrepareProductPictures. The component accepts arguments Picture1/Picture2/Picture3 from an Excel import and uses them without validating the path. An attacker can supply a crafted value that points outside the intended directory, allowing read access to arbitrary files on the host filesystem. The flaw is classified as CWE‑22 and can be triggered remotely via the Excel import interface, potentially exposing sensitive configuration files, logs, or other data.

Affected versions of the grandnode2 web shop software include all releases up through 2.3.0. The open‑source project reports that the initial codebase and the components are available on GitHub. An upgrade to grandnode2 2.4.0, which contains the commit 2abbaed232080ad74949c6f35581f0351e309972, resolves the vulnerability. No other vendors or versions are listed.

The CVSS score is 5.1, indicating a medium impact if exploited. The EPSS value is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no confirmed widespread exploitation. However, because the flaw is reachable remotely via an Excel import, an attacker with knowledge of the import process could craft a malicious file to gain file‑system access. Organizations running grandnode2 should treat the issue as low to medium risk, prioritising patching commensurate with their exposure to the import feature.