CVE-2026-41951 is a path traversal vulnerability affecting GROWI, Inc.'s GROWI product versions 7.5.0 and earlier. The vulnerability arises from improper limitation of a pathname to a restricted directory, enabling attackers to execute arbitrary Embedded JavaScript (EJS) templates on the server. This occurs specifically when the email server functionality is active within GROWI. The vulnerability has a CVSS 3.0 base score of 7.2, indicating high impact on confidentiality, integrity, and availability. No official remediation or patch has been published as of the data provided.

Successful exploitation could allow an attacker with high privileges to execute arbitrary EJS templates on the server, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. This could result in unauthorized code execution and control over the GROWI server environment. However, exploitation requires the email server feature to be enabled and the attacker to have high privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the email server functionality in GROWI and limit user privileges to reduce the risk of exploitation. Monitor vendor communications for updates on patches or official mitigations.