Growi Inc
Monthly
Unauthenticated file disclosure in GROWI (all versions before 8.0.2) exposes private page attachments to any caller who possesses a valid attachment identifier. The route handler retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts conditionally gates the page-viewer permission check on the presence of an authenticated session, meaning HTTP requests without a session entirely bypass authorization and receive the requested file. Both /attachment/:id and /download/:id endpoints are affected, and identifiers are obtainable by former users whose access was revoked or from any prior exposure of the attachment URL. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Remote path traversal in GROWI v7.5.0 and earlier allows authenticated administrators to execute arbitrary EJS templates on the server when an email server is configured. The vulnerability enables template injection through directory traversal, potentially leading to remote code execution. Exploitation requires high privileges (administrator role) and a specific deployment configuration with email server functionality enabled. No active exploitation confirmed in CISA KEV, but CVSS 8.6 reflects the severity of arbitrary code execution impact once prerequisites are met.
Remote denial of service via regular expression attack in GROWI allows unauthenticated network attackers to exhaust server resources by submitting maliciously crafted input strings that trigger catastrophic backtracking in regex processing (CWE-1333). GROWI, Inc.'s collaboration platform is vulnerable to ReDoS with a CVSS 4.0 base score of 8.7 (High), reflecting high availability impact through network-accessible, low-complexity exploitation requiring no privileges or user interaction. No CISA KEV listing or public exploit code identified at time of analysis, though vendor advisory confirms the vulnerability and provides remediation guidance.
Cross-user data exposure and tampering in GROWI v7.4.5 and earlier allows any authenticated user who learns a shared AI assistant's identifier to read or modify other users' OpenAI thread and message contents via API endpoints that omit authorization checks. The flaw stems from missing access control (CWE-862) on the AI assistant interaction layer rather than a memory-corruption or injection bug. No public exploit identified at time of analysis, and EPSS rates near-term exploitation probability at 0.04% (12th percentile).
Insecure Direct Object Reference in GROWI's bookmark folder APIs allows authenticated users to retrieve, modify, and delete other users' private bookmark data without authorization. Affected across all tracked versions per CPE data (cpe:2.3:a:growi,_inc.:growi:*:*:*:*:*:*:*:*), exploitation requires only a valid session - no elevated privileges. No public exploit code or CISA KEV listing exists at time of analysis, but the attack pattern (predictable or enumerable object IDs in API endpoints) is trivially reproducible by any authenticated user.
Incorrect authorization in GROWI exposes other users' bookmark data to unauthenticated remote attackers without any privileges or user interaction. The flaw (CWE-863) indicates that bookmark retrieval endpoints fail to enforce proper access control checks, allowing any network-accessible attacker to enumerate or read bookmark data belonging to arbitrary users. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided in the source intelligence.
Stored cross-site scripting in GROWI v7.4.6 and earlier allows authenticated users to inject malicious scripts that execute in other users' browsers, compromising confidentiality and integrity of user sessions. The vulnerability requires user interaction (clicking a link or viewing affected content) and authenticated access, resulting in a CVSS score of 5.4 (medium severity). No public exploit code or active KEV confirmation is indicated in available data.
Unauthenticated file disclosure in GROWI (all versions before 8.0.2) exposes private page attachments to any caller who possesses a valid attachment identifier. The route handler retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts conditionally gates the page-viewer permission check on the presence of an authenticated session, meaning HTTP requests without a session entirely bypass authorization and receive the requested file. Both /attachment/:id and /download/:id endpoints are affected, and identifiers are obtainable by former users whose access was revoked or from any prior exposure of the attachment URL. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Remote path traversal in GROWI v7.5.0 and earlier allows authenticated administrators to execute arbitrary EJS templates on the server when an email server is configured. The vulnerability enables template injection through directory traversal, potentially leading to remote code execution. Exploitation requires high privileges (administrator role) and a specific deployment configuration with email server functionality enabled. No active exploitation confirmed in CISA KEV, but CVSS 8.6 reflects the severity of arbitrary code execution impact once prerequisites are met.
Remote denial of service via regular expression attack in GROWI allows unauthenticated network attackers to exhaust server resources by submitting maliciously crafted input strings that trigger catastrophic backtracking in regex processing (CWE-1333). GROWI, Inc.'s collaboration platform is vulnerable to ReDoS with a CVSS 4.0 base score of 8.7 (High), reflecting high availability impact through network-accessible, low-complexity exploitation requiring no privileges or user interaction. No CISA KEV listing or public exploit code identified at time of analysis, though vendor advisory confirms the vulnerability and provides remediation guidance.
Cross-user data exposure and tampering in GROWI v7.4.5 and earlier allows any authenticated user who learns a shared AI assistant's identifier to read or modify other users' OpenAI thread and message contents via API endpoints that omit authorization checks. The flaw stems from missing access control (CWE-862) on the AI assistant interaction layer rather than a memory-corruption or injection bug. No public exploit identified at time of analysis, and EPSS rates near-term exploitation probability at 0.04% (12th percentile).
Insecure Direct Object Reference in GROWI's bookmark folder APIs allows authenticated users to retrieve, modify, and delete other users' private bookmark data without authorization. Affected across all tracked versions per CPE data (cpe:2.3:a:growi,_inc.:growi:*:*:*:*:*:*:*:*), exploitation requires only a valid session - no elevated privileges. No public exploit code or CISA KEV listing exists at time of analysis, but the attack pattern (predictable or enumerable object IDs in API endpoints) is trivially reproducible by any authenticated user.
Incorrect authorization in GROWI exposes other users' bookmark data to unauthenticated remote attackers without any privileges or user interaction. The flaw (CWE-863) indicates that bookmark retrieval endpoints fail to enforce proper access control checks, allowing any network-accessible attacker to enumerate or read bookmark data belonging to arbitrary users. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided in the source intelligence.
Stored cross-site scripting in GROWI v7.4.6 and earlier allows authenticated users to inject malicious scripts that execute in other users' browsers, compromising confidentiality and integrity of user sessions. The vulnerability requires user interaction (clicking a link or viewing affected content) and authenticated access, resulting in a CVSS score of 5.4 (medium severity). No public exploit code or active KEV confirmation is indicated in available data.