Growi CVE-2026-26291

The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C) indicates network-accessible attack surface with low complexity, requiring only low-privilege authentication and user interaction. While the CVSS base score of 5.4 is medium, the real-world risk depends on deployment context: in organizations where GROWI is used for sensitive documentation or collaborative content, stored XSS poses significant risk because the payload persists and affects all users viewing the compromised content, not just the attacker. The scope-change (S:C) reflects potential impact beyond the vulnerable application. However, the requirement for authenticated access and user interaction (UI:R) limits opportunistic exploitation. No EPSS score, KEV confirmation, or public POC are available in the input data, suggesting this is a reported but not yet widely exploited vulnerability. Organizations should prioritize patching based on GROWI's role in their infrastructure and the sensitivity of data stored within.

An authenticated user with content creation or editing privileges (e.g., wiki page author) crafts a malicious script and embeds it in a GROWI page or comment. When other authenticated users view the affected page, the script executes in their browsers with their session context, potentially stealing session cookies, redirecting to phishing pages, or performing unauthorized actions on their behalf. The attack requires the victim to visit the compromised page, but stored XSS ensures broad reach across all subsequent viewers.