Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding …

High CVSS 8.7

CVECVE-2026-71236

First seen2026-08-10 13:16 UTC

Disclosed2026-08-05 11:16 UTC

Last updated2026-08-10 13:16 UTC

Channel statusauto

Summary

Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &lt;, &gt;, and &amp; back to <, >, and & immediately after purification.

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Sources

NVD DATABASE

Original Links

https://github.com/grocy/grocy

Timeline

2026-08-10 nvd_ingest NVD