CVE-2019-12276: GrandNode LetsEncryptController path traversal allows file download

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote file disclosure with a high EPSS score and a CVSS base of 7.5, though no KEV listing or documented exploit tag.

What it is

GrandNode 4.40 contains a path traversal flaw in Controllers/LetsEncryptController.cs, reachable through LetsEncrypt/Index?fileName= requests. A remote, unauthenticated attacker can use crafted fileName values to read arbitrary files from the web server. The issue was patched on 2019-05-30 in GrandNode 4.40.

Impact

An attacker gains read access to arbitrary files on the web server, which can expose configuration files, credentials, and other sensitive data. There is no integrity or availability impact per the CVSS vector.

Attack surface

Reached over the network via HTTP requests to the LetsEncrypt/Index endpoint with a crafted fileName parameter. No authentication and no user interaction are required, per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is high at 0.57099 (99th percentile), indicating elevated likelihood of exploitation activity. References include a Packet Storm advisory and vendor/third-party advisories, but no public exploit tag is recorded.

What to do

• Apply the vendor patch released 2019-05-30 for GrandNode 4.40, or upgrade to a fixed release.
• Restrict or disable the LetsEncrypt/Index endpoint if it is not required in production.
• Validate and canonicalize the fileName parameter, rejecting traversal sequences and paths outside an allowed directory.
• Run the web application with least privilege and limit filesystem read access to only what the application needs.
• Monitor and block traversal patterns such as ../ and encoded variants at the WAF or reverse proxy.

Detection

• Search web logs for requests to LetsEncrypt/Index with fileName parameters containing ../ or encoded traversal sequences.
• Alert on unusual file reads or responses returning file contents from the LetsEncrypt endpoint.
• Monitor for access to sensitive paths (configuration, credential, or system files) originating from the web server process.
• Review outbound or anomalous file access patterns from the GrandNode host for signs of data exfiltration.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.