CVE-2026-71236 Grocy - Stored XSS via HTMLPurifier Output Double-Decode

Grocy's API request-body parser controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing , , and back to , and & immediately after purification...

PT-2026-68102

Name of the Vulnerable Software and Affected Versions Grocy affected versions not specified Description Stored Cross-Site Scripting XSS occurs due to an issue in the API request-body parser within controllers/Api/BaseApiController.php in the GetParsedAndFilteredRequestBody function. The system...

CVE-2026-71236: Improper Neutralization of Input During Web Page Generation

Grocy's API request-body parser controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing , , and & back to , and & immediately after purification...