The vulnerability arises from an inefficient regular expression that can be triggered by a specially crafted input string, causing excessive CPU usage and leading to a denial of service for the affected system. The weakness is identified as CWE‑1333, a regular expression denial of service attack.

GROWI provided by GROWI, Inc. is affected. No specific version information is supplied, so administrators should verify the installed build for exposure.

The CVSS score of 8.7 indicates high severity, yet the EPSS score of less than 1% suggests a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the submission of a malicious input string, presumably through an HTTP interface, although the precise pathway is not explicitly stated in the description and is inferred from the nature of the defect.