CyberRota Analysis
AI-GeneratedThe vulnerability affects Grocy's API, specifically in the request-body parser, which improperly handles HTML-entity encoding after using HTMLPurifier for input sanitization. This flaw allows for stored cross-site scripting (XSS) attacks through API-writable fields, potentially compromising user data and application integrity. Organizations utilizing Grocy's API should prioritize patching this vulnerability to protect against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &lt;, &gt;, and &amp; back to <, >, and & immediately after purification.