CVE-2026-71236

10th percentile - higher than 10% of all known CVEs

Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &amp;lt;, &amp;gt;, and &amp;amp; back to <, >, and & immediately after purification.

This encoding reversal may allow an attacker to bypass HTML purification and inject malicious HTML or JavaScript into the application, potentially leading to XSS attacks.

Update Grocy to a version that does not reverse entity encoding after purification, or apply additional protections such as re-sanitizing output data.