CVE-2026-41951highCWE-22

CVE-2026-41951: high-severity vulnerability in GROWI

Published

Follow this CVE+ Monitor GROWI

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 0.5%
Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email server is running in GROWI.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
GROWI, Inc. · GROWI
Related CVEs — GROWI

In the same product, most dangerous first.

CVE-2026-80191HIGHGROWI before 8.0.2 Missing Authorization on Attachment Retrieval for Unauthenticated RequestsEPSS 0.5%CVE-2026-41040HIGHCVE-2026-41040EPSS 0.4%CVE-2026-68951MEDIUMCVE-2026-68951EPSS 0.3%CVE-2025-43880MEDIUMCVE-2025-43880EPSS 0.3%CVE-2026-25083HIGHCVE-2026-25083EPSS 0.3%CVE-2026-53620MEDIUMCVE-2026-53620EPSS 0.3%