CVE-2026-71236 in Grocy
Summary
by MITRE • 08/05/2026
Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &lt;, &gt;, and &amp; back to <, >, and & immediately after purification. This double-decode reconstructs live HTML/script tags from the entity-encoded form that HTMLPurifier produced to neutralize them, re-introducing stored XSS across API-writable fields (products, recipes, stock, users, chores, and others) that are rendered elsewhere without re-sanitization.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability exists in Grocy's API request handling mechanism where the BaseApiController processes incoming data through a flawed sanitization workflow. The system first applies HTMLPurifier to cleanse field values, which effectively neutralizes potentially malicious HTML content by converting dangerous characters into their entity representations. However, the subsequent manual reversal of HTML-entity encoding creates a critical security gap where &lt; becomes <, &gt; becomes >, and &amp; becomes &, thereby reconstructing the original HTML/script tags that HTMLPurifier had previously neutralized. This double-decoding process fundamentally undermines the security measures designed to prevent cross-site scripting attacks.
The technical flaw operates through a specific sequence of operations that violates core web application security principles. When an attacker submits malicious content containing HTML or script tags through API writable fields, HTMLPurifier initially converts these dangerous elements into their respective entity representations, effectively neutralizing them. The subsequent manual decoding process then reverses this sanitization, restoring the original malicious code structure in the database. This vulnerability specifically affects multiple core data entities including products, recipes, stock records, user accounts, chores, and other writable fields that are subsequently rendered in web interfaces without additional sanitization.
The operational impact of this vulnerability is severe as it enables stored cross-site scripting attacks across the entire Grocy application ecosystem. Attackers can inject malicious JavaScript code through any writable API endpoint, which gets stored in the database and executed whenever the affected data is rendered in web interfaces. This creates persistent XSS vulnerabilities that can compromise user sessions, steal sensitive information, perform unauthorized actions on behalf of users, or redirect them to malicious sites. The vulnerability affects all users who interact with API-writable fields since there's no re-sanitization of stored data before rendering, creating a direct path for attackers to exploit.
The vulnerability aligns with CWE-79 (Cross-site Scripting) and follows patterns described in ATT&CK technique T1566 (Phishing) where attackers can establish persistent XSS channels through API endpoints. The flaw also represents a classic case of improper input validation and sanitization, where defensive measures are applied but then inadvertently neutralized by subsequent processing steps. Organizations using Grocy should implement immediate mitigations including removing the manual HTML-entity decoding process, ensuring all stored data undergoes consistent sanitization regardless of its source, and implementing proper output encoding for all rendered content. Additionally, the application should validate that HTMLPurifier's output is not subsequently modified in ways that could reintroduce security vulnerabilities, as this specific implementation pattern creates a dangerous precedent for other applications processing user input through multiple sanitization layers.