PT-2026-39589 · Growi · Growi

Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-41951

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GROWI versions prior to 7.5.1

Description A path traversal issue exists that may allow an attacker to execute arbitrary EJS (Embedded JavaScript) templates on the server. This occurs specifically when an email server is running within the application.

Recommendations Update to a version later than 7.5.0.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-41951

Affected Products

Growi

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-41951 · Security Note
• https://twitter.com/VulmonFeeds/status/2053797832935535000 · Twitter Post
• https://growi.co.jp/news/44 · Note
• https://twitter.com/0x2ed3bb60/status/2053794685685280785 · Twitter Post
• https://jvn.jp/jp/JVN38788367 · Note
• https://t.me/CVEtracker/53368 · Telegram Post
• https://twitter.com/CVEnew/status/2053954489971798527 · Twitter Post