Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then …

CVE-2026-71236 affects Grocy's API request-body parser in controllers/Api/BaseApiController.php. The vulnerability arises from a flawed sanitization sequence where HTMLPurifier is applied to input fields, but the application then manually reverses HTML entity encoding by replacing encoded entities back to raw characters. This double-decode process reconstructs live HTML and script tags that HTMLPurifier had neutralized, effectively bypassing the security control. The flaw enables stored XSS across multiple API-writable fields including products, recipes, stock, users, and chores. Since the reconstructed malicious content is stored and later rendered without re-sanitization, attackers can inject persistent scripts affecting all users who view the compromised data. The vulnerability has been rated high severity given its broad attack surface across core application features.