CVE-2020-5683

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-12-16 · updated 2026-06-17
Weakness: CWE-22

Description

Directory traversal vulnerability in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 series and earlier GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 series and earlier allows remote attackers to alter the data by uploading a specially crafted file.

Affected products

WESEEK, Inc. GROWI: through 3.8.2; from 4.1.0 before 4.1.12; from 4.2.0 before 4.2.3 — fixed in 4.1.12, 4.2.3

How to fix

Upgrade to a fixed version: WESEEK, Inc. GROWI 4.1.12, 4.2.3. Check the vendor advisory for mitigations.

References

https://github.com/weseek/growi
https://hub.docker.com/r/weseek/growi/
https://jvn.jp/en/jp/JVN94169589/index.html
https://github.com/weseek/growi
https://hub.docker.com/r/weseek/growi/
https://jvn.jp/en/jp/JVN94169589/index.html

Get alerted when CVE-2020-5683 or the next vulnerability affects your stack