Growi

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:growi,_inc.:growi:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorGrowi, Inc. (c1e33f2a-f83f-5f29-919a-fe47fa8e1f7c)
ProductGrowi (0bf0b85e-4b30-5012-90fd-d82f0c933683)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-109848 vulnerable 2026-11-03 10:17:39.393384 Details available
MEDIUM (4.2)
GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read permission and save them to pages that the attacker can edit.
Published: 2026-10-28T02:21:37.093Z
Updated: 2026-11-04T16:37:25.446Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-105272 vulnerable 2026-11-03 10:16:33.028963 Details available
MEDIUM (4.2)
GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain the contents and comments of pages without the required read permission.
Published: 2026-10-28T02:21:24.458Z
Updated: 2026-11-04T16:37:56.157Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-115624 vulnerable 2026-11-03 10:15:37.672995 Details available
MEDIUM (5.3)
GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts.
Published: 2026-10-28T02:21:49.154Z
Updated: 2026-11-04T16:36:42.899Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-41951 vulnerable 2026-06-08 08:03:15.803869 Details available
HIGH (7.2)
Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email server is running in GROWI.
Published: 2026-05-11T09:32:21.267Z
Updated: 2026-05-11T12:43:07.550Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-41040 vulnerable 2026-06-08 08:03:14.594795 Details available
HIGH (7.5)
GROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via a crafted input string.
Published: 2026-04-23T06:59:38.451Z
Updated: 2026-04-23T12:24:38.209Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-26291 vulnerable 2026-06-08 07:53:21.484625 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-25083 vulnerable 2026-06-08 07:53:18.934513 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-64700 vulnerable 2026-06-08 07:39:20.170244 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-61994 vulnerable 2026-06-08 07:37:28.506978 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-54806 vulnerable 2026-06-08 07:33:13.250771 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-43880 vulnerable 2026-06-08 07:25:10.438201 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.