GROWI CVE-2026-41040

No special conditions-remote unauthenticated exploitation against default configurations of GROWI collaboration platform. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible attack surface requiring no authentication, no user interaction, and low complexity. Exploitation depends only on identifying which input fields or API endpoints process user-supplied data through vulnerable regex patterns. Any GROWI instance exposed to network access (internal or internet-facing) where attackers can submit crafted input strings is vulnerable. No specific feature enablement, non-default configuration, or platform-specific deployment mode limits exploitation. Attack success is constrained only by network reachability to the GROWI service.

This represents a HIGH real-world risk for internet-facing GROWI deployments. The CVSS 4.0 score of 8.7 reflects availability impact (VA:H) through unauthenticated network exploitation (AV:N/AC:L/PR:N/UI:N), making it trivially exploitable by remote attackers without special conditions. Attack complexity is low (AC:L), meaning no specialized timing, race conditions, or information gathering is required-attackers simply send crafted strings to vulnerable endpoints. While no EPSS score is available for this recent CVE and no CISA KEV listing exists (suggesting no confirmed widespread exploitation), ReDoS vulnerabilities are highly automatable once vulnerable regex patterns and endpoints are identified through code review or fuzzing. The lack of public POC at time of analysis provides a brief window for patching before weaponization. SSVC decision factors: Exploitation is technically straightforward (automatable), technical impact is partial denial of service (availability degradation but not full system compromise), and mission impact depends on GROWI's role in organizational workflows. Organizations using GROWI for critical documentation or incident response should prioritize remediation immediately. The primary risk limitation is scope: only GROWI users are affected, not a widely deployed library, but for affected organizations this is a direct production availability risk.

An unauthenticated remote attacker identifies GROWI endpoints accepting user-controlled input (e.g., search queries, page content, user profile fields, API parameters). The attacker crafts input strings specifically designed to trigger catastrophic backtracking in vulnerable regex patterns-for example, submitting 'aaaaaaaaaaaaaaaaaaaaaaaaaaaa!' against a pattern like (a+)+ forces the regex engine into exponential matching attempts. By submitting multiple such requests concurrently or in rapid succession, the attacker exhausts server CPU resources, degrading response times for legitimate users or rendering the GROWI instance completely unresponsive until the regex operations time out or the server is restarted.