GROWI CVE-2025-54806

Exploitation requires that the victim be an authenticated/logged-in GROWI user who actively opens an attacker-crafted URL that abuses the page alert function (reflected XSS, CWE-79) - this user interaction (UI:A) and the victim's authenticated session are the primary limiting factors. The attacker themselves needs no credentials (PR:N) and can craft the URL remotely, but cannot trigger the flaw without a logged-in target clicking the link. Affected deployments are GROWI v4.2.7 and earlier; upgrading past the fixed release removes the condition.

This is a moderate, not high-priority, issue. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:A) describes a network-reachable reflected XSS that an attacker can trigger without their own credentials, but it requires active victim interaction (UI:A) - the victim must be an authenticated GROWI user who opens a crafted URL. Impact is limited: the 4.0 vector sets vulnerable-system C/I/A all to N and only assigns subsequent-system SC:L/SI:L, reflecting script execution in the victim's browser session rather than server compromise, consistent with CWE-79. All exploitation signals point to low real-world urgency: EPSS is 0.20% (10th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data. There is no SSVC decision data supplied. One nuance worth flagging: the CVSS assigns PR:N (no attacker privileges) while the description says the victim must be 'logged in' - these are consistent (PR refers to the attacker, the logged-in state is the victim-side UI condition captured by UI:A), so this is not a true conflict, but defenders should understand the attacker needs no account while the target does. Net: a legitimate but low-to-moderate web vulnerability with no evidence of active or automated exploitation.

An attacker crafts a malicious URL targeting the GROWI page alert function and delivers it (e.g., via email, chat, or a link) to a user who is already authenticated to the GROWI instance. When the victim opens the link in their browser, attacker-controlled script executes in the context of their GROWI session, potentially allowing session/token theft or actions performed as that user. No public proof-of-concept exploit was identified in the provided data.