CVE-2025-54806: Weseek GROWI XSS Vulnerability

CVE-2025-54806 Overview

CVE-2025-54806 is a cross-site scripting (XSS) vulnerability affecting GROWI v4.2.7 and earlier, a wiki collaboration platform developed by Weseek. The flaw resides in the page alert function and allows an attacker to execute arbitrary JavaScript in the browser of an authenticated user who visits a crafted URL. This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Successful exploitation can compromise session data, manipulate rendered content, or redirect users to attacker-controlled resources. Weseek has published a security advisory and remediation guidance through the GROWI Security Update notice and the JVN Advisory JVN46526244.

Critical Impact
Authenticated users who visit a crafted URL can trigger arbitrary script execution within their browser session, enabling session data theft and unauthorized actions in GROWI.

Affected Products

Weseek GROWI v4.2.7 and earlier
GROWI page alert function component
Self-hosted GROWI wiki deployments

Discovery Timeline

2025-10-23 - CVE-2025-54806 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54806

Vulnerability Analysis

CVE-2025-54806 is a reflected cross-site scripting flaw in the page alert feature of GROWI. The application fails to properly neutralize user-supplied input before rendering it within the alert component of a page. When a logged-in user opens a crafted URL, the browser interprets attacker-controlled payload data as executable JavaScript instead of inert text. The vulnerability requires user interaction, meaning the victim must click or otherwise navigate to the malicious link while authenticated to the affected GROWI instance. Because GROWI is deployed as an internal knowledge base in many organizations, a successful attack can expose sensitive collaboration content and session artifacts. The issue is limited to browser-side impact and does not directly compromise the server host.

Root Cause

The root cause is improper output encoding within the page alert rendering path. Input passed through URL parameters is inserted into the Document Object Model (DOM) without adequate sanitization or contextual escaping. This violates the neutralization requirements described in CWE-79 and permits script content to execute in the user's origin context.

Attack Vector

Exploitation is network-based and requires the victim to be authenticated to a vulnerable GROWI instance. The attacker crafts a URL containing a malicious payload targeting the page alert parameter and delivers it through phishing, chat, or embedded content. When the victim opens the link, the payload executes with the privileges of the victim's browser session. The vulnerability does not require attacker credentials on the target GROWI system.

No verified public proof-of-concept code has been released. See the JVN Advisory JVN46526244 for the vendor's technical description.

Detection Methods for CVE-2025-54806

Indicators of Compromise

Requests to GROWI URLs containing encoded HTML tags, <script> markers, or javascript: schemes in query parameters targeting the page alert function.
Outbound browser connections to unfamiliar domains initiated shortly after users load GROWI pages.
Unexpected session token access or account activity following clicks on external links pointing to internal GROWI hosts.

Detection Strategies

Inspect web server and reverse proxy logs for GROWI requests containing suspicious characters such as <, >, %3C, %3E, or onerror= in query strings.
Deploy Content Security Policy (CSP) reporting endpoints to capture violations triggered by injected inline scripts.
Correlate authenticated GROWI sessions with anomalous DOM-based redirects using browser telemetry or web application firewall logs.

Monitoring Recommendations

Monitor GROWI application logs for repeated access to the page alert endpoint from external referrers.
Alert on user reports of unexpected pop-ups, redirects, or credential prompts within GROWI pages.
Track version banners in GROWI HTTP responses to identify unpatched instances still running v4.2.7 or earlier.

How to Mitigate CVE-2025-54806

Immediate Actions Required

Upgrade GROWI to the fixed release published by Weseek in the GROWI Security Update advisory.
Inventory all GROWI deployments and confirm which instances run v4.2.7 or earlier.
Notify users to avoid clicking untrusted GROWI links until systems are patched.

Patch Information

Weseek addressed CVE-2025-54806 in a GROWI release following v4.2.7. Administrators should follow the vendor upgrade instructions in the GROWI Security Update advisory and the JVN Advisory JVN46526244. Verify the running version after upgrade using the GROWI admin console.

Workarounds

Restrict GROWI access to trusted networks or VPN-only reachability until patches are applied.
Enforce a strict Content Security Policy that disallows inline scripts and unknown script sources for the GROWI origin.
Educate users to avoid opening GROWI URLs received from external or untrusted sources.

bash

# Example Content Security Policy header for reverse proxy in front of GROWI
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'";