GROWI versions 7.4.6 and earlier suffer a stored cross‑site scripting flaw that allows an attacker to inject arbitrary JavaScript into the system’s database. When a victim later views a page that renders the malicious content, the script runs in the victim’s browser with the user’s privileges, potentially enabling cookie theft, session hijacking or defacement of the displayed page. This is a classic stored XSS described as CWE‑79.

The affected product is GROWI by GROWI Inc. The vulnerability exists in all releases up to and including v7.4.6. No information is provided about a patch release, so administrators should verify whether a newer version is available.

The CVSS score of 4.8 indicates a medium severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet become a widely exploited threat. It is inferred that the attack vector requires an attacker to create or modify content that will be displayed to other users; when that content is rendered, the malicious script executes in the victim’s browser. The potential impact includes data theft, session hijack, and site defacement, and could affect any user who views the injected content.