Read the docs

GROWI, Inc.

Records14All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

GROWI, Inc. records in CISA KEV

No GROWI, Inc. vulnerabilities are listed in CISA KEV.

Records

14 records

TI-2026-30347 CVE-2026-41951 · GHSA-x9j3-g3hc-fc94

Path traversal in GROWI, Inc. GROWI

Priority MEDIUM 40

Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email server is running in GROWI.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00495 Published 2026-05-11 No fix listed CWE-22
TI-2026-20258 CVE-2026-25083 · GHSA-c69x-9x9c-p9v7

Missing authorization in GROWI, Inc. GROWI

Priority MEDIUM 40

GROWI OpenAI thread/message API endpoints do not perform authorization.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.0032 Published 2026-03-16 No fix listed CWE-862
TI-2026-67628 CVE-2026-100727 · GHSA-h2pc-3fh7-hv26

Improper access control in GROWI exposes files on non-public pages

Priority LOW 36

An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00233 Published 2026-10-05 Fixed in v7.5.5 CWE-552
TI-2026-48471 CVE-2026-68951 · GHSA-qx8p-4g5w-55fv

Incorrect authorization in GROWI, Inc. GROWI

Priority LOW 36

GROWI contains an incorrect authorization vulnerability.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00334 Published 2026-08-31 No fix listed CWE-863
TI-2026-38668 CVE-2026-53620 · GHSA-xwvv-h48v-hrrm

Authorization bypass in GROWI, Inc. GROWI

Priority LOW 24

GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00289 Published 2026-08-31 No fix listed CWE-639
TI-2025-40046 CVE-2025-64700 · GHSA-j8xw-g4x6-3hq4

Cross-site request forgery in GROWI, Inc. GROWI

Priority LOW 22

Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00125 Published 2025-12-17 No fix listed CWE-352
TI-2026-21258 CVE-2026-26291 · GHSA-w2qc-5jvx-3g3v

Cross-site scripting in GROWI, Inc. GROWI

Priority LOW 21

Stored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00183 Published 2026-04-15 No fix listed CWE-79
TI-2025-38318 CVE-2025-61994 · GHSA-rrj6-v2g6-p956

Cross-site scripting in GROWI, Inc. GROWI

Priority LOW 21

Cross-site scripting vulnerability exists in GROWI prior to v7.2.10.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00184 Published 2025-11-06 Fixed in v7.2.10 CWE-79
TI-2026-81645 CVE-2026-109848 · GHSA-j29w-qwmj-w2j8

Authorization bypass in GROWI tag and page update APIs

Priority LOW 11

GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00222 Published 2026-10-28 No fix listed CWE-639
TI-2026-81641 CVE-2026-105272 · GHSA-496g-3857-hf6v

Authorization bypass in GROWI exposes page contents and comments

Priority LOW 11

GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00177 Published 2026-10-28 No fix listed CWE-639
Open these records in search →