Published:2026/05/11  Last Updated:2026/05/11

JVN#38788367
GROWI vulnerable to path traversal

Overview

GROWI provided by GROWI, Inc. contains a path traversal vulnerability.

Products Affected

  • GROWI v7.5.0 and earlier
Note that the product is affected only when an email server is running in GROWI.

Description

GROWI provided by GROWI, Inc. contains the following vulnerability.

  • Path traversal (CWE-22)
    • CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.6
    • CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 7.2
    • CVE-2026-41951

Impact

A path traversal vulnerability may allow an attacker to execute arbitrary EJS templates on the server, which could lead to arbitrary command execution or denial-of-service (DoS) conditions.

Solution

Update the Software
Update the software to the latest version. The developer has released the following version to address this vulnerability.

  • GROWI v7.5.1
For more details, refer to the information provided by the developer.

Vendor Status

Vendor Status Last Update Vendor Notes
GROWI, Inc. Vulnerable 2026/05/11 GROWI, Inc. website

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

GROWI, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and GROWI, Inc. coordinated under the Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2026-41951
JVN iPedia JVNDB-2026-000071