Is CVE-2026-100727 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100727 being exploited in the wild.

How severe is CVE-2026-100727?

Medium severity, with a CVSS score of 5.3, published 5 October 2026.

Which products and versions are affected?

GROWI, Inc. GROWI prior to v7.5.5.

Is there a fix for CVE-2026-100727?

Yes: fixed in GROWI v7.5.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100727 attacked?

It is attacked over the network.

Am I affected by CVE-2026-100727?

Check whether you run GROWI or Inc. GROWI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100727: GROWI improper access control in file upload

CVE-2026-100727 · Severity: medium · CVSS 5.3 · Published 2026-10-05

GROWI is a collaborative wiki platform used to document and share organizational knowledge. An improper access control vulnerability allows unauthenticated attackers to read files stored in non-public pages when the file upload feature is configured to store files locally, exposing sensitive information that should have been restricted.

Vendors: GROWI, Inc..

Quick answers

Is CVE-2026-100727 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100727 being exploited in the wild.
How severe is CVE-2026-100727?: Medium severity, with a CVSS score of 5.3, published 5 October 2026.
Which products and versions are affected?: GROWI, Inc. GROWI prior to v7.5.5.
Is there a fix for CVE-2026-100727?: Yes: fixed in GROWI v7.5.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100727 attacked?: It is attacked over the network.
Am I affected by CVE-2026-100727?: Check whether you run GROWI or Inc. GROWI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: GROWI v7.5.5

Technical details

GROWI contains a CWE-552 (Files or Directories Accessible to External Parties) vulnerability in its file handling logic. When local file upload storage is configured, an unauthenticated attacker can access files in non-public pages without proper authorization checks. The vulnerability requires network access and affects versions prior to v7.5.5.

Affected products

GROWI, Inc. GROWI prior to v7.5.5

Timeline

2026-10-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.