CVE-2026-71236: Grocy: Stored XSS via HTMLPurifier Output Double-Decode
Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &lt;, &gt;, and &amp; back to <, >, and & immediately after purification. This double-decode reconstructs live HTML/script tags from the entity-encoded form that HTMLPurifier produced to neutralize them, re-introducing stored XSS across API-writable fields (products, recipes, stock, users, chores, and others) that are rendered elsewhere without re-sanitization.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71236?
The severity of CVE-2026-71236 is rated as high with a score of 8.
How do I fix CVE-2026-71236?
To fix CVE-2026-71236, ensure that HTMLPurifier is properly configured and avoid manually reversing HTML-entity encoding in your application.
What type of vulnerability is described in CVE-2026-71236?
CVE-2026-71236 is a stored cross-site scripting (XSS) vulnerability.
What impact does CVE-2026-71236 have on my application?
CVE-2026-71236 could allow an attacker to inject malicious scripts that may execute in the context of a user's session.
In which software is CVE-2026-71236 found?
CVE-2026-71236 is found in the Grocy software.