CVE-2026-71236 — Grocy - Stored XSS via HTMLPurifier Output Double-Decode

CVE-2026-71236

Grocy - Stored XSS via HTMLPurifier Output Double-Decode PUBLISHED

Description (CNA)

Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &lt;, &gt;, and &amp; back to <, >, and & immediately after purification.

Affected (CNA)

Vendor / product	Versions
grocy / grocy	affected 0

CWE

CWE-79

References

https://github.com/grocy/grocy

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.