High severity8.7NVD Advisory· Published Aug 5, 2026· Updated Aug 26, 2026
CVE-2026-71236
CVE-2026-71236
Description
Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing <, >, and & back to <, >, and & immediately after purification.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
News mentions
0No linked articles in our index yet.