CVE-2026-71236

8.7 HIGHpublic exploit available

Published 2026-08-05 · Updated 2026-08-10

AI risk analysis

Summary: The flaw allows for injection of HTML entities that are later improperly decoded, potentially leading to Cross-Site Scripting (XSS) attacks.
Exploitability: Exploitation requires sending crafted API requests with specific HTML entities; moderate skill level needed.
Blast radius: If exploited, this could lead to unauthorized script execution in users' browsers, compromising sensitive data or redirecting users to malicious sites.
Prioritized remediation: Update Grocy to a version that properly handles and decodes input to prevent XSS vulnerabilities.

xssapiwebdecoding

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &lt;, &gt;, and &amp; back to <, >, and & immediately after purification.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Weaknesses

CWE-79

Public exploit & PoC references

https://github.com/grocy/grocy

All references

https://github.com/grocy/grocy

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.