Growi, Inc.

8 CVEs across 1 Growi, Inc. products. Browse Growi, Inc. vulnerabilities, severities, and proof-of-concept exploits.

Growi, Inc. products with known CVEs

ProductCVEs
Growi8
Growi, Inc. CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-41951High7.22026-05-11Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email ser…
CVE-2026-41040High7.52026-04-23GROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via a crafted input string.
CVE-2026-26291Medium5.42026-04-15Stored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier. If this vulnerability is exploited, an arbitrary script may be executed in a user…
CVE-2026-25083High8.32026-03-16GROWI OpenAI thread/message API endpoints do not perform authorization. Affected are v7.4.5 and earlier versions. A logged-in user who knows a shared AI assist…
CVE-2025-64700Medium4.32025-12-17Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier. If a user views a malicious page while logged in, the user may be tricked to do un…
CVE-2025-61994Medium5.42025-11-06Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing crafted contents, an arbitrary script may be…
CVE-2025-54806Medium6.12025-10-23GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function. If a user accesses a crafted URL while logged in to the aff…
CVE-2025-43880Medium4.32025-06-25Inefficient regular expression complexity issue exists in GROWI prior to v7.1.6. If exploited, a logged-in user may cause a denial of service (DoS) condition.