Growi, Inc. Growi
8 CVEs affecting Growi, Inc. Growi. Latest disclosed: 2026-05-11. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-25083 | High | 8.3 | 2026-03-16 | GROWI OpenAI thread/message API endpoints do not perform authorization. Affected are v7.4.5 and earlier versions. A logged-in user who knows a shared AI assist… |
CVE-2026-41040 | High | 7.5 | 2026-04-23 | GROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via a crafted input string. |
CVE-2026-41951 | High | 7.2 | 2026-05-11 | Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email ser… |
CVE-2025-54806 | Medium | 6.1 | 2025-10-23 | GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function. If a user accesses a crafted URL while logged in to the aff… |
CVE-2026-26291 | Medium | 5.4 | 2026-04-15 | Stored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier. If this vulnerability is exploited, an arbitrary script may be executed in a user… |
CVE-2025-61994 | Medium | 5.4 | 2025-11-06 | Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing crafted contents, an arbitrary script may be… |
CVE-2025-64700 | Medium | 4.3 | 2025-12-17 | Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier. If a user views a malicious page while logged in, the user may be tricked to do un… |
CVE-2025-43880 | Medium | 4.3 | 2025-06-25 | Inefficient regular expression complexity issue exists in GROWI prior to v7.1.6. If exploited, a logged-in user may cause a denial of service (DoS) condition. |