CVE-2019-12276 describes a Path Traversal vulnerability in GrandNode 4.40, specifically within the LetsEncryptController. This flaw allows remote, unauthenticated attackers to retrieve arbitrary files from the web server by crafting malicious HTTP requests. The vulnerability carries a CVSS score of 7.5 (High), indicating a critical risk due to its network-based attack vector, low attack complexity, and high confidentiality impact without requiring user interaction. While it does not appear on the KEV catalog, its high EPSS score of 0.91455 suggests a significant likelihood of exploitation. Exploit code is publicly available, with Nuclei templates and an ExploitDB entry (EDB-47027) confirming its exploitability. Despite this, there is no evidence of active exploitation, and community discussion or media coverage remains minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
4.40CPE matchmatch criteria | cpe:2.3:a:grandnode:grandnode:4.40:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.