CVE-2026-100727: Medium severity GROWI GROWI vulnerability
Published Oct 5, 2026
·Updated
An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".
Affected Software
1 affected component
GROWI GROWI
Event History
Oct 5, 2026
CVE Published
via MITRE·06:36 AM
Data Sourced
via MITRE·06:36 AM
DescriptionSeverity
Data Sourced
via NVD·07:16 AM
DescriptionSeverityWeakness
Jun 28, 58730
Event
via NVD·08:19 PM
Frequently Asked Questions
1
Which deployments are exposed?
GROWI deployments are affected when the file upload setting is configured as "Local." The issue concerns files contained in non-public pages.
2
What does an attacker need to exploit this issue?
An attacker can exploit the issue remotely without authentication or user interaction. Successful exploitation allows reading affected files, but the provided information does not indicate integrity or availability impact.