CVE-2026-41951: Path Traversal
Published May 11, 2026
·Updated
Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email server is running in GROWI.
Affected Software
1 affected component
GROWI GROWI<=7.5.0
Event History
May 11, 2026
CVE Published
via MITRE·09:32 AM
Data Sourced
via MITRE·09:32 AM
DescriptionSeverity
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeakness
Apr 21, 58328
Event
via NVD·12:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2026-41951?
CVE-2026-41951 is considered a high severity vulnerability due to its potential to allow arbitrary EJS template execution.
2
How do I fix CVE-2026-41951?
To fix CVE-2026-41951, upgrade GROWI to version 7.5.1 or later to mitigate the path traversal vulnerability.
3
What versions of GROWI are affected by CVE-2026-41951?
GROWI versions 7.5.0 and earlier are affected by CVE-2026-41951.
4
Can CVE-2026-41951 lead to remote code execution?
Yes, CVE-2026-41951 may allow an attacker to execute arbitrary code on the server via crafted EJS templates.
5
Is an email server required for exploiting CVE-2026-41951?
Yes, the presence of an email server is necessary for the exploitation of CVE-2026-41951.