CVE-2026-100727: GROWI Information Disclosure Vulnerability

CVE-2026-100727 Overview

CVE-2026-100727 is an improper access control vulnerability in GROWI, an open-source wiki platform. The flaw allows an unauthenticated remote attacker to read files attached to non-public pages when the file upload setting is configured as Local. The issue is categorized under [CWE-552: Files or Directories Accessible to External Parties]. Exploitation requires no authentication, no user interaction, and no elevated privileges. The vulnerability affects confidentiality of file attachments stored on affected GROWI instances, while integrity and availability are not impacted.

Critical Impact
Unauthenticated remote attackers can retrieve attachments from non-public GROWI pages when local file storage is enabled, exposing internal documents intended for restricted audiences.

Affected Products

GROWI (configurations using Local file upload setting)
See the GROWI News Update for affected version details
See the JVN Security Advisory JVN24352487 for additional product information

Discovery Timeline

2026-10-05 - CVE-2026-100727 published to NVD
2026-10-05 - Last updated in NVD database

Technical Details for CVE-2026-100727

Vulnerability Analysis

The vulnerability resides in how GROWI serves file attachments when the storage backend is configured as Local. Access control checks that normally restrict visibility of non-public pages are not consistently enforced on the underlying file endpoints. An attacker who can reach the GROWI web interface over the network can request attachment resources directly and receive their contents without authenticating.

The weakness maps to [CWE-552: Files or Directories Accessible to External Parties]. Only files bound to non-public pages hosted via the local filesystem backend are in scope. Instances configured to store attachments in object storage services such as Amazon S3 or Google Cloud Storage are not affected by this specific flaw.

Root Cause

The root cause is missing or incomplete authorization enforcement on the file-serving code path used by the Local upload backend. The page-level permission model that governs wiki content is not uniformly applied to the attachment retrieval endpoint. As a result, direct requests for attachment resources bypass the restriction that would otherwise require authentication and page-level access rights.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker enumerates or guesses attachment identifiers exposed by the GROWI instance and issues HTTP requests to the file-serving endpoint. If the targeted instance uses the Local file upload configuration, the server returns the attachment content regardless of the parent page's visibility settings.

No verified public exploit code is available at the time of publication. Refer to the GROWI News Update and the JVN Security Advisory JVN24352487 for authoritative technical details.

Detection Methods for CVE-2026-100727

Indicators of Compromise

Unauthenticated HTTP GET requests to GROWI attachment endpoints returning 200 OK responses with file content
Access log entries showing attachment downloads from client IP addresses that never completed an authentication flow
Spikes in sequential or enumerated attachment identifier requests from a single source

Detection Strategies

Review GROWI web server access logs for requests to attachment URLs that lack valid session cookies or authentication tokens
Compare attachment access patterns against the list of users authorized to view the parent page
Alert on bulk attachment downloads originating from external or unexpected network ranges

Monitoring Recommendations

Forward GROWI application and reverse proxy logs to a centralized logging platform for correlation and retention
Baseline normal attachment access volume per user and per IP, then alert on deviations
Monitor the GROWI configuration for changes to the file upload backend setting

How to Mitigate CVE-2026-100727

Immediate Actions Required

Upgrade GROWI to the fixed release identified in the GROWI News Update
Audit the current file upload setting and confirm whether the Local backend is in use
Review attachment access logs for signs of unauthenticated retrieval prior to patching

Patch Information

The GROWI maintainers have published remediation guidance in the GROWI News Update and the JVN Security Advisory JVN24352487. Administrators should apply the vendor-supplied fixed version that enforces authorization checks on the local file-serving endpoint.

Workarounds

Restrict network access to the GROWI instance using a reverse proxy, VPN, or allowlist until the patch is applied
Migrate attachment storage from the Local backend to a supported object storage provider that is not affected by this flaw
Temporarily remove sensitive attachments from non-public pages until the fixed version is deployed

bash

# Example: restrict GROWI access at the reverse proxy layer
# nginx snippet limiting attachment endpoint to internal networks
location /attachment/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://growi_backend;
}