A path traversal flaw in GROWI v7.5.0 and earlier allows an attacker to craft a request that references directories outside the intended file scope. When the email server component is enabled, this flaw enables the attacker to instruct the server to render arbitrary EJS templates, which are executed with the same privileges as the web application and can run arbitrary JavaScript code on the host.

GROWI Inc. GROWI, versions 7.5.0 and earlier are affected by this vulnerability.

The CVSS score of 8.6 classifies the issue as high severity. Although the EPSS score is below 1 %, indicating a low probability of widespread exploitation, the vulnerability is not yet listed in the CISA KEV catalogue. The likely attack vector is local or requires an attacker who can influence the email server component, as the flaw is exploitable only when the server is running. Successful exploitation would give the attacker full control over the application’s runtime environment, leading to compromise of the underlying system.