Is CVE-2026-41040 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41040 being exploited in the wild.

How severe is CVE-2026-41040?

High severity, with a CVSS score of 7.5, published 23 April 2026.

Which products and versions are affected?

GROWI, Inc. GROWI v7.5.0 and earlier.

Is there a fix for CVE-2026-41040?

A patch was published on 2026-04-28: Vendor update status confirmed; version 7.5.1 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41040 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-41040?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41040: GROWI ReDoS denial of service via crafted input string

CVE-2026-41040 · Severity: high · CVSS 7.5 · Published 2026-04-23

GROWI, a collaborative wiki and knowledge management platform, is vulnerable to a security flaw that can be used to crash the service. By sending a specially crafted text string, an attacker can overwhelm the system's processing power, making the platform unavailable to legitimate users. This could disrupt business operations and internal documentation access until the service is restored.

Quick answers

Is CVE-2026-41040 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41040 being exploited in the wild.
How severe is CVE-2026-41040?: High severity, with a CVSS score of 7.5, published 23 April 2026.
Which products and versions are affected?: GROWI, Inc. GROWI v7.5.0 and earlier.
Is there a fix for CVE-2026-41040?: A patch was published on 2026-04-28: Vendor update status confirmed; version 7.5.1 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41040 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-41040?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

GROWI v7.5.0 and earlier contains an inefficient regular expression complexity vulnerability (CWE-1333). An unauthenticated remote attacker can exploit this by providing a specially crafted input string that triggers catastrophic backtracking during regex evaluation. This results in excessive CPU consumption, leading to a Denial of Service (DoS) condition for the application. The vulnerability is addressed in GROWI v7.5.1 and later versions.

Affected products

GROWI, Inc. GROWI v7.5.0 and earlier

Timeline

2026-04-23: disclosed
2026-04-23: advisory
2026-04-28: patched: Vendor update status confirmed; version 7.5.1 released.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.