CVE-2026-41951: Improper limitation of a pathname to a restricted directory ('Path Traversal') in GROWI, Inc. GROWI
A path traversal vulnerability (CVE-2026-41951) exists in GROWI version 7.5.0 and earlier. This vulnerability may allow an attacker to execute arbitrary EJS templates on the server when the email server feature is enabled in GROWI. The vulnerability has a high severity rating with a CVSS score of 7.2. No official patch or remediation guidance is currently provided by the vendor. Exploitation in the wild is not known at this time.
AI Analysis
Technical Summary
CVE-2026-41951 is a path traversal vulnerability affecting GROWI, Inc.'s GROWI product versions 7.5.0 and earlier. The flaw allows an attacker to bypass directory restrictions and execute arbitrary Embedded JavaScript (EJS) templates on the server, but only when the email server functionality is active. This can lead to full confidentiality, integrity, and availability impacts as indicated by the CVSS vector. The vulnerability was published on May 11, 2026, and no official remediation or patch has been documented yet.
Potential Impact
Successful exploitation could result in remote code execution on the affected server, compromising confidentiality, integrity, and availability of the system. This could allow attackers to run arbitrary code via crafted path traversal attacks targeting the email server feature in GROWI. No known exploits in the wild have been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the email server feature if feasible or restrict access to the GROWI server to trusted users only. Monitor vendor communications for updates on patches or official mitigations.
CVE-2026-41951: Improper limitation of a pathname to a restricted directory ('Path Traversal') in GROWI, Inc. GROWI
Description
A path traversal vulnerability (CVE-2026-41951) exists in GROWI version 7.5.0 and earlier. This vulnerability may allow an attacker to execute arbitrary EJS templates on the server when the email server feature is enabled in GROWI. The vulnerability has a high severity rating with a CVSS score of 7.2. No official patch or remediation guidance is currently provided by the vendor. Exploitation in the wild is not known at this time.
CVSS v3.0
Score 7.2high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-41951 is a path traversal vulnerability affecting GROWI, Inc.'s GROWI product versions 7.5.0 and earlier. The flaw allows an attacker to bypass directory restrictions and execute arbitrary Embedded JavaScript (EJS) templates on the server, but only when the email server functionality is active. This can lead to full confidentiality, integrity, and availability impacts as indicated by the CVSS vector. The vulnerability was published on May 11, 2026, and no official remediation or patch has been documented yet.
Potential Impact
Successful exploitation could result in remote code execution on the affected server, compromising confidentiality, integrity, and availability of the system. This could allow attackers to run arbitrary code via crafted path traversal attacks targeting the email server feature in GROWI. No known exploits in the wild have been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the email server feature if feasible or restrict access to the GROWI server to trusted users only. Monitor vendor communications for updates on patches or official mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- jpcert
- Date Reserved
- 2026-04-27T08:21:56.914Z
- Cvss Version
- 3.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a01aa21cbff5d8610f2b703
Added to database: 5/11/2026, 10:06:25 AM
Last enriched: 5/18/2026, 10:48:55 AM
Last updated: 6/18/2026, 4:27:38 AM
Views: 81
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.