CVE-2026-105272

A path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email server is running in GROWI.

GROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via a crafted input string.

GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts.

GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read permission and save them to pages that the attacker can edit.

An improper access control vulnerability exists in GROWI, which allows an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".

GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier they can access with an arbitrary revision identifier to read revision content from pages they lack permission to view.

GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers.

GROWI contains an incorrect authorization vulnerability. If exploited, an unauthenticated attacker could retrieve other users' bookmark data.

GROWI contains an authorization bypass vulnerability through user-controlled key in bookmark folder APIs. An authenticated attacker could retrieve, tamper with, and/or delete other users' bookmark data.

GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam skips the check when the user is null, so a request without a session skips the check and returns the file. An unauthenticated attacker with an attachment identifier can download the file even if the page is private. Version 8.0.2 checks both authenticated and unauthenticated requests.