Threat Intelligence Database

GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier they can access with an arbitrary revision identifier to read revision content from pages they lack permission to view.

GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers.

GROWI versions prior to 8.0.2 have a missing authorization check for attachment requests when the request is unauthenticated. This allows an unauthenticated attacker with knowledge of an attachment identifier to retrieve files regardless of page privacy or permission settings. Version 8.0.2 fixes this by enforcing permission checks for both authenticated and unauthenticated requests, except when a valid share link is used.

A path traversal vulnerability (CVE-2026-41951) exists in GROWI version 7.5.0 and earlier. This vulnerability may allow an attacker to execute arbitrary EJS templates on the server when the email server feature is enabled in GROWI. The vulnerability has a high severity rating with a CVSS score of 7.2. No official patch or remediation guidance is currently provided by the vendor. Exploitation in the wild is not known at this time.

GROWI, Inc. 's GROWI product version 7.5.0 and earlier contains a vulnerability due to inefficient regular expression complexity, which can be exploited via crafted input strings to cause a denial of service. This vulnerability is classified as a regular expression denial of service (ReDoS). The CVSS v3.0 score is 7.5, indicating a high severity impact primarily affecting availability. There is no information about an official patch or remediation level from the vendor, and no known exploits are reported in the wild. The vulnerability requires no privileges and no user interaction to exploit over the network.

GROWI version 7.4.6 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows execution of arbitrary scripts in a user's browser if exploited. This vulnerability has a medium severity rating with a CVSS score of 5.4. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

GROWI OpenAI thread/message API endpoints do not perform authorization. Affected are v7.4.5 and earlier versions. A logged-in user who knows a shared AI assistant's identifier may view and/or tamper the other user's threads/messages.

HighVulnerabilityUnited StatesJapanGermany+7#cve#cve-2026-25083

Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier. If a user views a malicious page while logged in, the user may be tricked to do unintended operations.

MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2025-64700

Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing crafted contents, an arbitrary script may be executed on the web browser of a victim user who accesses the page.

MediumVulnerabilityGermanyFranceUnited Kingdom+7#cve#cve-2025-61994

GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function. If a user accesses a crafted URL while logged in to the affected product, an arbitrary script may be executed on the user's web browser.

MediumVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2025-54806