CVE-2026-71236

HIGH

Grocy - Stored XSS via HTMLPurifier Output Double-Decode

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-71236 has a selected CVSS score of 8.7 (high).

Description

Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &lt;, &gt;, and &amp; back to <, >, and & immediately after purification.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 5, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

grocy

Browse grocy / grocy

Default status: unknown

CVE ListVersion range not suppliedaffected

References

2