CVE-2026-41951
Last modified
CVE-2026-41951 is a high-severity vulnerability rated 8.6/10 on the CVSS scale. Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email server is running in GROWI.. EPSS estimates a 0.50% chance of exploitation in the next 30 days.
Description
Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email server is running in GROWI.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-41951?
How severe is CVE-2026-41951?
How do I fix CVE-2026-41951?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-41940cPanel and WHM versions after 11.40 contain an authenticatio…9.8
- CVE-2026-41947Dify before version 1.14.2 contains an authorization bypass …9.3
- CVE-2026-41948Dify version 1.14.1 and prior contain a path traversal vulne…9.4
- CVE-2026-41949Dify before version 1.14.2 contains an authorization bypass …7.5
- CVE-2026-4195A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L,…9.8
- CVE-2026-41950Dify before version 1.14.0 contains an authorization bypass …6.5
- CVE-2026-41952Local privilege escalation due to improper input validation.…7.8
- CVE-2026-41953A vulnerability exists in BIG-IP systems where a highly priv…8.7
- CVE-2026-41954Sensitive information disclosure vulnerability exists in the…6.9
- CVE-2026-41956When a classification profile is configured on a UDP virtual…8.7
- CVE-2026-41957An authenticated remote code execution vulnerability through…8.8
- CVE-2026-41959Incorrect permission assignment vulnerabilities exist in BIG…7.1
Are you affected by CVE-2026-41951?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST