An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".

An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".

GROWI provided by GROWI, Inc. contains the following vulnerability:<a href='https://cwe.mitre.org/data/definitions/552.html' target='_blank'></a><ul><li>Files or Directories Accessible to External Parties (CWE-552) - CVE-2026-100727</li></ul>GROWI, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and GROWI, Inc. coordinated under the Information Security Early Warning Partnership.