Is CVE-2026-41951 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41951 being exploited in the wild.

How severe is CVE-2026-41951?

High severity, with a CVSS score of 7.2, published 11 May 2026.

Which products and versions are affected?

WESEEK GROWI v7.5.0 and earlier.

Is there a fix for CVE-2026-41951?

A patch was published on 2026-05-11: Fixed in version v7.5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41951 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-41951?

Check whether you run WESEEK GROWI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41951: GROWI path traversal in EJS template execution

CVE-2026-41951 · Severity: high · CVSS 7.2 · Published 2026-05-11

GROWI is a popular open-source wiki and knowledge management platform. A security flaw in its file handling allows an attacker with high-level administrative privileges to access restricted directories on the server. If an email server is configured within the application, this could lead to the execution of malicious code, potentially resulting in a full system takeover or data theft.

Technologies: WESEEK GROWI. Vendors: WESEEK.

Quick answers

Is CVE-2026-41951 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41951 being exploited in the wild.
How severe is CVE-2026-41951?: High severity, with a CVSS score of 7.2, published 11 May 2026.
Which products and versions are affected?: WESEEK GROWI v7.5.0 and earlier.
Is there a fix for CVE-2026-41951?: A patch was published on 2026-05-11: Fixed in version v7.5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41951 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-41951?: Check whether you run WESEEK GROWI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in GROWI versions v7.5.0 and earlier. The flaw is exploitable when an email server is configured within the GROWI environment. An attacker with high privileges (PR:H) can leverage this vulnerability to bypass directory restrictions and execute arbitrary EJS (Embedded JavaScript) templates on the host server. This can lead to remote code execution (RCE), arbitrary OS command execution, or a denial-of-service (DoS) condition. The issue is resolved in GROWI v7.5.1.

Affected products

GROWI GROWI v7.5.0 and earlier

Timeline

2026-05-11: disclosed
2026-05-11: advisory
2026-05-11: patched: Fixed in version v7.5.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.