GROWI vulnerabilities
We track 3 vulnerabilities in GROWI products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 26, 2026.
Latest GROWI vulnerabilities
- 7.5 High severity
GROWI: Missing Authorization
GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requiring the user to be
- 8.6 High severity
GROWI: Improper Limitation of a Pathname to a Restricted Directory
Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email server is running in GROWI.
- 8.7 High severity
GROWI: Missing Authorization
GROWI OpenAI thread/message API endpoints do not perform authorization. Affected are v7.4.5 and earlier versions. A logged-in user who knows a shared AI assistant's identifier may view and/or tamper the other user's threads/messages.