CVE-2026-71236CWE-79cross-site-scripting

CVE-2026-71236

High · published August 5, 2026

CVSS v3.1
8.7
EPSS
0%
Percentile
27.7
In the wild
Unconfirmed
What it is

Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &amp;lt;, &amp;gt;, and &amp;amp; back to <, >, and & immediately after purification.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00353 · 27.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-05T15:16Z
References (1)
https://github.com/grocy/grocy · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
EPSS history
Timeline
  • 05 AUG 10:56Z
    Grocy - Stored XSS via HTMLPurifier Output Double-Decode
    cvelistv5