CVE-2025-10216: GrandNode Voucher ConfirmOrder race condition
A vulnerability was detected in GrandNode up to 2.3.0. The impacted element is an unknown function of the file /checkout/ConfirmOrder/ of the component Voucher Handler. The manipulation of the argument giftvouchercouponcode results in race condition. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is regarded as difficult. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10216?
CVE-2025-10216 has been classified as a high severity vulnerability due to its potential for exploitation in a race condition.
How do I fix CVE-2025-10216?
To fix CVE-2025-10216, upgrade your GrandNode to version 2.3.1 or higher where the vulnerability has been patched.
What types of attacks are possible with CVE-2025-10216?
CVE-2025-10216 could allow attackers to exploit the race condition remotely, potentially leading to unauthorized actions on the site.
Which versions of GrandNode are affected by CVE-2025-10216?
All versions of GrandNode up to 2.3.0 are affected by CVE-2025-10216.
What components are involved in CVE-2025-10216?
CVE-2025-10216 involves the Voucher Handler component within the ConfirmOrder function related to gift voucher processing.