Grocy's API request‑body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) sanitizes incoming field values with HTMLPurifier and then manually reverses the HTML‑entity encoding of the purified output by replacing <, >, and & with <, >, and & immediately after purification. This double‑decode process restores any raw HTML and script tags that had been neutralized. As a result, an attacker can store malicious content in any API‑writable field—producing stored XSS when the data is rendered without re‑sanitization. The flaw enables arbitrary script execution in the browsers of any user who views the affected page, compromising confidentiality, integrity, and availability of the application’s data.

The vulnerability affects installations of Grocy across all modules that accept API input for text fields. All current versions lacking the double‑decode fix are potentially exploitable until a patch is applied. No specific version information is available, so administrators should assume all released releases are vulnerable until confirmed otherwise.

With a CVSS score of 8.7, the issue is classified as high severity. The EPSS score is < 1%, indicating a very low probability of exploitation, yet the vulnerability remains not listed in CISA’s KEV catalog. Attackers can exploit the flaw via the network by sending crafted API requests that include script tags; attackers do not need elevated privileges beyond write access to the vulnerable fields. The effect is the execution of malicious scripts in the context of any user who views the stored data.