Une vulnérabilité de falsification de requête intersite (Cross-site request forgery) existe dans GROWI v7.3.3 et versions antérieures. Si un utilisateur consulte une page malveillante tout en étant connecté, il peut être amené à effectuer des opérations non intentionnelles.

The primary impact of this XSRF vulnerability lies in the potential for unauthorized actions performed on behalf of an authenticated user. An attacker could craft a malicious page that, when viewed by a logged-in GROWI user, triggers unintended operations within the GROWI instance. This could include creating, deleting, or modifying knowledge base articles, changing user permissions, or executing other administrative tasks. The blast radius is limited to the scope of actions a user can perform within GROWI, but the consequences can be significant if an attacker gains control of an administrator account.

Organizations using GROWI for knowledge management, particularly those with multiple users or administrator accounts, are at risk. Environments with weak password policies or a lack of MFA are especially vulnerable. Shared hosting environments where multiple GROWI instances reside on the same server should also be considered at higher risk.

• nodejs / server:

  npm audit growi

• generic web:

  curl -I https://your-growi-instance/ | grep -i 'content-security-policy'

• generic web:

  grep -r "/growi/api/" /var/log/apache2/access.log

1. 2025-12-17Disclosure

   disclosure

1. Réservé2025-11-10
2. Publiée2025-12-17
3. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-64700 is to upgrade GROWI to version 7.3.4 or later, which contains the fix. If immediate upgrading is not possible, consider implementing additional security layers such as requiring multi-factor authentication (MFA) for all GROWI users, particularly administrators. Implementing strict content security policy (CSP) headers can also help mitigate XSRF attacks by restricting the sources from which scripts can be executed. Monitor GROWI logs for suspicious activity, especially unusual requests originating from unfamiliar sources.