Skip to content
OpenAdvisories

Vendor

GROWI

15 known vulnerabilities.

Products

GROWI 15
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.5
    CVE-2026-80191

    GROWI before 8.0.2 Missing Authorization on Attachment Retrieval for Unauthenticated Requests

    GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requiring the user to be…

    GROWI GROWI
  • High 7.2
    CVE-2026-41951

    Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS t…

    GROWI GROWI
  • High 7.5
    CVE-2026-41040

    GROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via a crafted input strin…

    GROWI GROWI
  • High 8.3
    CVE-2026-25083

    GROWI OpenAI thread/message API endpoints do not perform authorization. Affected are v7.4.5 and earlier versions. A log…

    GROWI GROWI