GROWI CVE-2026-100727

Exploitation requires that the GROWI instance be configured with its file upload setting set to 'Local' (local filesystem storage) - this is the explicit precondition named in the description; instances using cloud/object storage (e.g., S3/GCS) backends are not stated to be affected. No authentication is required (PR:N) and no user interaction is needed (UI:N), and the attacker must have network reachability to the GROWI service. Impact is limited to disclosure of files attached to non-public pages; it does not grant write access or code execution. The configuration dependency on 'Local' storage is the primary factor limiting the exploitable population.

This is a moderate-severity information disclosure flaw (CVSS 3.0 base 5.3) whose real-world priority is bounded by its limited impact and conditional trigger. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates a network-reachable, low-complexity, unauthenticated issue with only low confidentiality impact and no integrity or availability effect - consistent with reading files from non-public pages rather than full system compromise. No EPSS score was provided in the input, so exploitation-probability cannot be quantified here. There is no CISA KEV listing and no public exploit code referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The key limiting factor is the configuration precondition: the flaw is only exploitable when GROWI's file upload setting is 'Local,' which narrows the exploitable population and argues against treating this as an indiscriminate, widespread threat. Net assessment: a legitimate but non-critical issue - patch in normal cycles unless the deployment uses 'Local' file storage and hosts sensitive non-public pages, in which case prioritize. Note that the description emphasizes access to non-public page files, while the CWE/tags cite Path Traversal and File Upload - the precise retrieval mechanism (direct object reference vs. traversal) is not fully disambiguated in the provided data.

An attacker who can reach a GROWI instance over the network - without any credentials - requests files that are attached to private or otherwise non-public wiki pages and retrieves their contents directly. This works only when the instance stores uploads with the 'Local' file upload setting. No public proof-of-concept exploit was identified in the provided intelligence, and the low attack complexity means a correctly formed request is sufficient once the target configuration is known.