Which versions of GROWI are affected by CVE-2026-41951?

GROWI v7.5.0 and earlier contains a high-severity remote code execution vulnerability affecting authenticated administrators who can inject arbitrary code through email server template processing.

How to fix or mitigate CVE-2026-41951?

Within 24 hours: identify all GROWI deployments running v7.5.0 or earlier with email server configuration enabled and document administrator account holders. Within 7 days: restrict administrator role to essential personnel only, enforce multi-factor authentication on all administrative accounts, and disable email server functionality if not actively required. Within 30 days: monitor vendor advisories for patch release and plan immediate deployment; if patch remains unavailable, evaluate alternative wiki platforms or air-gap affected GROWI instances from production networks.

GROWI CVE-2026-41951

Q: What is the CVSS score of CVE-2026-41951?

CVE-2026-41951 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29047 HIGH

Path Traversal (CWE-22)

2026-05-11 jpcert

GHSA-x9j3-g3hc-fc94

Path Traversal Growi

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 11, 2026 - 10:31 vuln.today

CVSS changed

May 11, 2026 - 10:22 NVD

7.2 (HIGH) 8.6 (HIGH)

CVE Published

May 11, 2026 - 09:32 nvd

HIGH 8.6

DescriptionCVE.org

Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email server is running in GROWI.

AnalysisAI

Remote path traversal in GROWI v7.5.0 and earlier allows authenticated administrators to execute arbitrary EJS templates on the server when an email server is configured. The vulnerability enables template injection through directory traversal, potentially leading to remote code execution. Exploitation requires high privileges (administrator role) and a specific deployment configuration with email server functionality enabled. No active exploitation confirmed in CISA KEV, but CVSS 8.6 reflects the severity of arbitrary code execution impact once prerequisites are met.

Technical ContextAI

GROWI is an open-source team wiki and knowledge base platform built on Node.js. This vulnerability affects the EJS (Embedded JavaScript) template rendering engine integration within GROWI's email functionality. CWE-22 path traversal occurs when user-controlled input is insufficiently validated before being used in file system operations. In this case, an authenticated administrator can manipulate file paths to traverse directories and reference arbitrary EJS template files on the server filesystem. When GROWI's email server component processes these malicious paths, it renders the attacker-specified templates, allowing execution of embedded JavaScript code server-side. The affected product per CPE is cpe:2.3:a:growi,_inc.:growi:*:*:*:*:*:*:*:* covering all versions through 7.5.0.

RemediationAI

Upgrade GROWI to version 7.5.1 or later, which addresses the path traversal vulnerability in EJS template handling per vendor advisory at https://growi.co.jp/news/44/. Organizations unable to immediately patch should implement compensating controls: disable email server functionality in GROWI configuration if not business-critical, restrict GROWI administrative access to only essential personnel with verified credentials, implement file system access controls to limit template directory traversal, and monitor authentication logs for suspicious admin activity. Note that disabling email functionality eliminates the attack vector entirely but removes notification capabilities. Network segmentation does not mitigate this issue as it requires authenticated access already presumed to have network connectivity.