What is CVE-2026-71236?
A vulnerability was found in Grocy's API request-body parser (BaseApiController.php, GetParsedAndFilteredRequestBody): after sanitizing with HTMLPurifier, it manually reverses HTML-entity encoding (&lt; → '<', etc.). This can restore script tags and lead to stored XSS attacks. Grocy administrators should urgently update or filter API inputs.
Azərbaycanca: Grocy API-sində (BaseApiController.php, GetParsedAndFilteredRequestBody) zəiflik aşkarlanıb: HTMLPurifier ilə təmizlənmiş dəyərlər dərhal əks kodlaşdırılır (&lt;, &gt;, &amp; → '<', '>', '&'). Bu, <script> kimi HTML teqlərin bərpasına səbəb olaraq XSS hücumuna yol aça bilər. Grocy istifadəçiləri təcili yeniləməli və ya API daxilolmalarını filter etməlidir.
Related CVEs
link basis: same weakness class CWE-79
FAQ1
Why does the sanitization in Grocy’s API become ineffective?
The GetParsedAndFilteredRequestBody function in BaseApiController.php manually reverses HTML-entity encoding (e.g., &lt; to '<') right after HTMLPurifier sanitization. This restores tags like <script> and enables stored XSS attacks.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.