GROWI EUVD-2026-29047

Requires authenticated access with GROWI administrator privileges (PR:H in CVSS vector). Email server functionality must be configured and actively running in the GROWI deployment - installations without email features enabled are not vulnerable through this path. The vulnerability affects specifically the EJS template rendering component within email operations, meaning the email subsystem must be initialized and accessible to the authenticated administrator. Default GROWI installations may not have email server enabled, significantly limiting real-world attack surface to organizations that have explicitly configured this feature.

Real-world risk is moderate despite the 8.6 CVSS score. The CVSS:4.0 vector shows AV:N/AC:L indicating network-accessible exploitation with low complexity, but critically requires PR:H (high privileges) meaning only users with administrative access can exploit this. The attack surface is further constrained by requiring email server functionality to be actively configured and running in GROWI. No EPSS data provided, no CISA KEV listing indicates this is not being actively exploited in the wild, and no public POC availability confirmed. The technical impact is severe (VC:H/VI:H/VA:H) with potential for complete server compromise, but the scope is unchanged (SC:N/SI:N/SA:N) limiting lateral movement. Primary risk exists in environments where GROWI administrators are not fully trusted or where admin credentials may be compromised. Organizations without email server functionality enabled in GROWI face zero risk from this specific vector. This represents a classic 'high severity, narrow attack surface' scenario requiring prioritization only where both prerequisites exist.

An attacker with compromised administrator credentials authenticates to GROWI and navigates to email configuration functionality. They craft a malicious request containing path traversal sequences (e.g., ../../malicious.ejs) that bypasses directory restrictions when GROWI processes email templates. The server renders the attacker-controlled EJS template, executing embedded JavaScript code with the privileges of the GROWI application process, achieving remote code execution and full server compromise.