CVE-2025-61994: GROWI XSS Vulnerability

CVE-2025-61994 Overview

CVE-2025-61994 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in GROWI, an open-source wiki platform developed by WESEEK, Inc. The flaw affects GROWI versions prior to v7.2.10. An authenticated user who can create pages can embed crafted content that executes arbitrary JavaScript in the browser of any victim who later views the page. Exploitation requires the victim to interact with the malicious page. Successful attacks can hijack sessions, perform actions on behalf of the victim, or exfiltrate content accessible within the wiki context.

Critical Impact
Authenticated attackers can inject scripts into GROWI pages that execute in other users' browsers, enabling session theft, unauthorized wiki actions, and content disclosure within the affected wiki instance.

Affected Products

GROWI versions prior to v7.2.10
WESEEK, Inc. GROWI wiki platform (self-hosted deployments)
GROWI instances allowing standard user page creation

Discovery Timeline

2025-11-06 - CVE-2025-61994 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61994

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in GROWI's page rendering pipeline. A user with permission to create or edit pages can insert crafted content that GROWI fails to sanitize before rendering. When another authenticated user opens the page, the browser executes the attacker-controlled script in the context of the GROWI application origin.

Because GROWI is a collaborative wiki, page content is trusted content that many users view. This design amplifies the reach of stored XSS. The attacker's script inherits the victim's session cookies, CSRF tokens, and same-origin access to GROWI APIs. An attacker can pivot from a low-privileged authoring role to actions performed under an administrator's session if an admin views the poisoned page.

Root Cause

The root cause is insufficient output encoding or input sanitization of user-supplied page content prior to browser rendering. Markdown, HTML, or embedded attributes accepted by the editor bypass GROWI's XSS filters in versions before v7.2.10. The vendor advisory does not disclose the specific parser component or injection sink.

Attack Vector

Exploitation requires network access to the GROWI instance, low-privileged authentication, and victim interaction with the crafted page. An attacker with a valid account creates or edits a wiki page containing the malicious payload. The attacker then shares or links the page so that other users, ideally privileged ones, visit it. Upon page load, the injected script runs with the victim's authenticated session.

No verified public proof-of-concept code is available for CVE-2025-61994. Refer to the JVN Security Vulnerability Notice and the GROWI Security News Update for vendor-published details.

Detection Methods for CVE-2025-61994

Indicators of Compromise

GROWI page revisions containing <script>, javascript: URIs, or unusual event handler attributes such as onerror, onload, or onmouseover
Unexpected outbound HTTP requests from user browsers to attacker-controlled domains after loading specific wiki pages
New administrator accounts, permission changes, or API tokens created shortly after a privileged user viewed an untrusted page
Session tokens or cookies appearing in web server logs of external hosts referenced from GROWI content

Detection Strategies

Audit the GROWI page revision history for HTML tags, inline scripts, or encoded payloads that should not appear in normal wiki content
Deploy a Content Security Policy (CSP) in report-only mode to surface script executions from unexpected sources
Review reverse proxy and application logs for anomalous POST requests to page edit endpoints followed by rapid views from other accounts
Correlate authentication events with page access to identify sessions performing actions immediately after loading a suspicious page

Monitoring Recommendations

Enable verbose logging on the GROWI application layer for page creation, edit, and rendering events
Forward web server, application, and identity provider logs to a centralized data lake for cross-source correlation
Alert on privileged account activity that follows visits to recently modified or externally shared wiki pages
Monitor egress traffic from client workstations for connections to domains referenced inside GROWI page content

How to Mitigate CVE-2025-61994

Immediate Actions Required

Upgrade all GROWI instances to version 7.2.10 or later without delay
Inventory existing pages created or edited by non-trusted accounts and review them for suspicious markup
Rotate session secrets, API tokens, and administrator credentials if compromise is suspected
Restrict page creation and edit permissions to trusted users where the business allows

Patch Information

WESEEK, Inc. has released GROWI v7.2.10, which addresses CVE-2025-61994. Administrators should follow the upgrade instructions in the GROWI Security News Update. Coordinated disclosure details are documented in the JVN Security Vulnerability Notice.

Workarounds

Enforce a strict Content Security Policy that disables inline scripts and restricts script sources to trusted origins
Place GROWI behind a web application firewall (WAF) with rules that block common XSS payload patterns in page edit requests
Temporarily limit page creation and editing to a small set of vetted accounts until patching completes
Educate users to avoid opening wiki pages received from untrusted internal accounts until the instance is upgraded

bash

# Configuration example: upgrade GROWI via Docker Compose
docker compose pull growi
docker compose up -d growi

# Verify running version matches v7.2.10 or later
docker exec -it growi cat package.json | grep '"version"'