Compliance Impact

The provided information does not specify how the stored cross-site scripting (XSS) vulnerability in GROWI affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-26291 is a stored cross-site scripting (XSS) vulnerability found in GROWI versions 7.4.6 and earlier.

This vulnerability exists in the file upload feature, where attackers can upload specially crafted HTML files that execute arbitrary scripts in the browsers of users who access those files.

When exploited, this allows an attacker to run malicious scripts in a user's web browser, potentially redirecting logged-in users to phishing sites or executing other harmful content.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can lead to arbitrary script execution in the browsers of users accessing the affected GROWI system.

This can result in users being redirected to phishing sites or having malicious content executed in their browsers.

Although direct impacts such as cookie theft from the GROWI domain are limited when files are served from external domains, the risk of session compromise or user data exposure remains.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability exists in GROWI versions 7.4.6 and earlier, specifically in the file upload feature where crafted HTML files can be uploaded to execute arbitrary scripts in users' browsers.

Detection would involve identifying if your system is running a vulnerable version of GROWI (7.4.6 or earlier) and monitoring for suspicious file uploads or unexpected HTML files being served.

No specific detection commands are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate and recommended mitigation step is to update GROWI to version 7.4.7 or later.

Version 7.4.7 introduces controls over the Content-Disposition header, forcing files with MIME types not approved by administrators to be downloaded as attachments, which prevents script execution in browsers.

Additionally, review and restrict file upload permissions and monitor for any suspicious file uploads until the update is applied.

Useful 0 Not Useful 0