Home Tools CVE CVE-2026-71236
HIGH

CVE-2026-71236

2026-08-05 CVSS v3.1
CVSS
8.7

Description

Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &amp;lt;, &amp;gt;, and &amp;amp; back to <, >, and & immediately after purification.

Weakness (CWE)

CWE-79 Cross-site Scripting (XSS)

EPSS Score

0.2%
Probability of exploitation in next 30 days
10th percentile

References

https://github.com/grocy/grocy
View on dbcve.org
Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.
Back to CVE