CVE-2026-100727 GROWI, Inc. CVE debrief

Who should care

Defenders responsible for GROWI instances should assess exposure and implement compensating controls to restrict file access and monitor for potential unauthorized file reads. This includes verifying GROWI instance configuration, reviewing compensating controls, and monitoring for potential unauthorized file reads. Operators, administrators, and security teams should be aware of the vulnerability and its potential  »

Why it matters

CVE-2026-100727 is an improper access control vulnerability in GROWI that allows unauthenticated attackers to read files in non-public pages when the file upload setting is configured as 'Local'. Defenders responsible for GROWI instances should assess exposure and implement compensating controls to restrict file access and monitor for potential unauthorized file reads.

• Verify GROWI instance configuration and exposure to unauthorized file reads
• Implement compensating controls to restrict file access and monitor for potential unauthorized file reads

Technical summary

The vulnerability exists in GROWI and allows unauthenticated attackers to read files contained in non-public pages when the file upload setting is configured as 'Local'. The vulnerability has a CVSS score of 6.9 and is classified as MEDIUM severity. The affected product is GROWI, and the vulnerability class is improper access control. Defenders should prioritize verifying exposure and implementing compensating controls.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls.

Recommended defensive actions

• Verify GROWI instance exposure and configuration
• Implement compensating controls to restrict file access
• Monitor for potential unauthorized file reads

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability and its impact. The vulnerability allows unauthenticated attackers to read files contained in non-public pages of the affected product when the file upload setting is configured as 'Local'. The source detail is limited, and defenders should verify GROWI instance configuration and exposure to unauthorized file reads. Evidence is based on CVE Program and NVD sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.