Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier. If a user views a malicious page while logged in, the user may be tricked to do unintended operations.

The primary impact of this XSRF vulnerability lies in the potential for unauthorized actions performed on behalf of an authenticated user. An attacker could craft a malicious page that, when viewed by a logged-in GROWI user, triggers unintended operations within the GROWI instance. This could include creating, deleting, or modifying knowledge base articles, changing user permissions, or executing other administrative tasks. The blast radius is limited to the scope of actions a user can perform within GROWI, but the consequences can be significant if an attacker gains control of an administrator account.

Organizations using GROWI for knowledge management, particularly those with multiple users or administrator accounts, are at risk. Environments with weak password policies or a lack of MFA are especially vulnerable. Shared hosting environments where multiple GROWI instances reside on the same server should also be considered at higher risk.

• nodejs / server:

  npm audit growi

• generic web:

  curl -I https://your-growi-instance/ | grep -i 'content-security-policy'

• generic web:

  grep -r "/growi/api/" /var/log/apache2/access.log

1. 2025-12-17Disclosure

   disclosure

1. Reserviert2025-11-10
2. Veröffentlicht2025-12-17
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-64700 is to upgrade GROWI to version 7.3.4 or later, which contains the fix. If immediate upgrading is not possible, consider implementing additional security layers such as requiring multi-factor authentication (MFA) for all GROWI users, particularly administrators. Implementing strict content security policy (CSP) headers can also help mitigate XSRF attacks by restricting the sources from which scripts can be executed. Monitor GROWI logs for suspicious activity, especially unusual requests originating from unfamiliar sources.