CVE-2026-41951: GROWI Path Traversal Vulnerability

CVE-2026-41951 Overview

CVE-2026-41951 is a path traversal vulnerability [CWE-22] affecting GROWI v7.5.0 and earlier. GROWI is an open-source wiki platform developed by WESEEK, Inc. The flaw allows an attacker with high privileges to traverse directory paths and execute arbitrary Embedded JavaScript (EJS) templates on the server. Exploitation requires that an email server is running within GROWI. Successful exploitation leads to arbitrary code execution within the GROWI application context, compromising confidentiality, integrity, and availability of the wiki instance.

Critical Impact
An authenticated attacker can execute arbitrary EJS templates on the GROWI server when the email server feature is enabled, leading to server-side code execution.

Affected Products

GROWI v7.5.0
GROWI versions earlier than v7.5.0
GROWI deployments with the email server feature enabled

Discovery Timeline

2026-05-11 - CVE-2026-41951 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-41951

Vulnerability Analysis

The vulnerability resides in how GROWI processes file paths when loading EJS templates used by the email server feature. GROWI relies on EJS for rendering email content from template files stored on the server. The application fails to sanitize user-controllable input that influences the template path passed to the EJS rendering engine. An attacker who supplies a crafted path containing directory traversal sequences can break out of the intended template directory.

Once outside the intended directory, the attacker can reference arbitrary files on the file system as EJS templates. The EJS engine evaluates these files as templates, executing any embedded JavaScript they contain. Because EJS templates support inline JavaScript via <% %> tags, rendering an attacker-controlled file results in server-side code execution within the GROWI process.

Root Cause

The root cause is insufficient validation of file path input used during EJS template resolution [CWE-22]. GROWI concatenates or resolves untrusted input into a template path without enforcing that the resulting path remains within an allowed base directory. Sequences such as ../ allow the path to escape the intended boundary.

Attack Vector

The attack is conducted over the network and requires high privileges within GROWI. The email server feature must be active for the vulnerable code path to be reachable. An authenticated attacker submits a request that causes GROWI to resolve a template path containing traversal sequences. The EJS engine then loads and executes the referenced file as a template. Code examples are not publicly available; refer to the GROWI Update Announcement and JVN Security Advisory JVN38788367 for technical context.

Detection Methods for CVE-2026-41951

Indicators of Compromise

Requests to GROWI email-related endpoints containing path traversal sequences such as ../, ..\, or URL-encoded equivalents (%2e%2e%2f).
Unexpected .ejs or non-template file references in GROWI application logs tied to email server operations.
Outbound network connections or process spawns originating from the GROWI Node.js process that do not match baseline behavior.

Detection Strategies

Inspect GROWI HTTP access logs for parameters referencing email templates that contain traversal patterns or absolute paths.
Monitor the GROWI Node.js process for child process creation, file system reads outside the application's template directory, or unexpected shell invocations.
Correlate administrative or privileged user actions in GROWI with subsequent anomalous server behavior, since exploitation requires high privileges.

Monitoring Recommendations

Enable verbose application logging for GROWI email subsystem actions and forward logs to a centralized analytics platform.
Establish a baseline of expected EJS templates loaded by the email server and alert on deviations.
Track configuration changes to the GROWI email server setting and review accounts holding administrative privileges.

How to Mitigate CVE-2026-41951

Immediate Actions Required

Upgrade GROWI to a version later than v7.5.0 that addresses the path traversal flaw, as described in the GROWI Update Announcement.
Audit GROWI administrator and privileged accounts and revoke unnecessary high-privilege roles.
Review GROWI access logs for prior requests containing path traversal sequences against email-related endpoints.

Patch Information

WESEEK, Inc. has released a fixed version of GROWI. Operators should apply the update referenced in the GROWI Update Announcement and the advisory at JVN38788367. The patch addresses the improper limitation of pathname to a restricted directory in the EJS template loading logic.

Workarounds

Disable the GROWI email server feature until the patched version is deployed, since exploitation requires that the email server is running.
Restrict administrative access to GROWI through network controls such as VPN or IP allow lists to reduce the population of users able to reach the vulnerable functionality.
Place GROWI behind a web application firewall configured to block requests containing directory traversal sequences in template-related parameters.

bash

# Configuration example: disable the GROWI mail/email server feature
# Refer to GROWI documentation for exact environment variable names in your version
export MAIL_TRANSMISSION_METHOD=""
export SMTP_HOST=""
export SMTP_PORT=""
# Restart GROWI after applying changes
systemctl restart growi