CVE-2026-26291

Vulnerability

GROWI v7.4.6 and earlier contain a stored cross-site scripting (XSS) vulnerability in the file upload functionality. An attacker can upload a crafted HTML file that, when accessed by another user, executes arbitrary scripts in the user's browser [1][2].

Exploitation

To exploit this vulnerability, the attacker must have login access to the GROWI instance. The attacker uploads a malicious HTML file, and when other users view the file, the script runs. The attack requires user interaction (viewing the file). If files are served from an external domain like S3, direct cookie theft from the GROWI domain is limited [1].

Impact

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to phishing, defacement, or other malicious actions. The CVSS v3 base score is 5.4 (Medium) [2].

Mitigation

The vulnerability is fixed in GROWI v7.4.7. This version introduces Content-Disposition header control, forcing downloads for unallowed MIME types, preventing script execution in the browser. Users should update immediately [1][2].