CVE-2026-100727: Growi, Inc Growi

Medium severity, CVSS 6.9. EPSS: 0.2% chance of exploitation in the next 30 days.

An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".

Affected products

• Growi, Inc Growi: before v7.5.5 (fixed in v7.5.5)

Published 2026-10-05. Last modified 2026-10-05.