Threat database

An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".

GROWI contains an authorization bypass vulnerability in its bookmark folder APIs that allows an authenticated attacker to access and manipulate other users' bookmark data. This vulnerability can lead to unauthorized retrieval, modification, or deletion of bookmark information. The issue affects the GROWI product, but no specific affected versions or patches have been identified yet. The vulnerability has a medium severity rating with a CVSS score of 6.3.

GROWI contains an incorrect authorization vulnerability that allows an unauthenticated attacker to access other users' bookmark data. This vulnerability does not require user interaction or privileges and has a medium severity rating based on a CVSS score of 5.3. No specific affected versions or patches are currently identified.

GROWI versions prior to 8.0.2 have a missing authorization check for attachment requests when the request is unauthenticated. This allows an unauthenticated attacker with knowledge of an attachment identifier to retrieve files regardless of page privacy or permission settings. Version 8.0.2 fixes this by enforcing permission checks for both authenticated and unauthenticated requests, except when a valid share link is used.

A path traversal vulnerability (CVE-2026-41951) exists in GROWI version 7.5.0 and earlier. This vulnerability may allow an attacker to execute arbitrary EJS templates on the server when the email server feature is enabled in GROWI. The vulnerability has a high severity rating with a CVSS score of 7.2. No official patch or remediation guidance is currently provided by the vendor. Exploitation in the wild is not known at this time.

GROWI, Inc. 's GROWI product version 7.5.0 and earlier contains a vulnerability due to inefficient regular expression complexity, which can be exploited via crafted input strings to cause a denial of service. This vulnerability is classified as a regular expression denial of service (ReDoS). The CVSS v3.0 score is 7.5, indicating a high severity impact primarily affecting availability. There is no information about an official patch or remediation level from the vendor, and no known exploits are reported in the wild. The vulnerability requires no privileges and no user interaction to exploit over the network.

GROWI version 7.4.6 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows execution of arbitrary scripts in a user's browser if exploited. This vulnerability has a medium severity rating with a CVSS score of 5.4. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

GROWI OpenAI thread/message API endpoints do not perform authorization. Affected are v7.4.5 and earlier versions. A logged-in user who knows a shared AI assistant's identifier may view and/or tamper the other user's threads/messages.

Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier. If a user views a malicious page while logged in, the user may be tricked to do unintended operations.

Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing crafted contents, an arbitrary script may be executed on the web browser of a victim user who accesses the page.

GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function. If a user accesses a crafted URL while logged in to the affected product, an arbitrary script may be executed on the user's web browser.

Inefficient regular expression complexity issue exists in GROWI prior to v7.1.6. If exploited, a logged-in user may cause a denial of service (DoS) condition.