Read the docs
TI-2024-07762 Aliases CVE-2024-8370GHSA-fvhw-w3qc-hw2r

Grocy SVG File Upload recipepictures cross site scripting

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

A vulnerability classified as problematic was found in Grocy up to 4.2.0. This vulnerability affects unknown code of the file /api/files/recipepictures/ of the component SVG File Upload Handler. The manipulation of the argument force_serve_as with the input picture' leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. Unfortunately, the project maintainer does not want to be quoted in any way regarding the dispute rationale. The security policy of the project implies that this finding is "practically irrelevant" due to authentication requirements.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0043 37th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Grocy4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.1.0; 4.2.0—No fix listedCNA
  • Grocy Vendor— Affected 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.1.0; 4.2.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:grocy_project:grocy:*:*:*:*:*:*:*:*up to 4.2.0VulnerableGrocy project
  • cpe:2.3:a:grocy_project:grocy:*:*:*:*:*:*:*:* Versions up to 4.2.0 Vulnerable ·Grocy project

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-8370
  2. 2026-10-03 Alias added: GHSA-fvhw-w3qc-hw2r

References

—

  • TI-2024-36769 Cross-site scripting in Grocy CVSS 3.1CRITICAL 9.0
  • TI-2024-36771 Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password. CVSS 3.1HIGH 8.1
  • TI-2023-26073 Cross Site Scripting vulnerability in Grocy v.4.0.3 allows a local attacker to execute… CVSS 3.1MEDIUM 5.4
  • TI-2023-26071 A Cross-Site Scripting (XSS) vulnerability in the 'product description' component within… CVSS 3.1MEDIUM 5.4
  • TI-2023-26070 Cross-Site Scripting (XSS) vulnerability in the ‘manageApiKeys’ component of Grocy 4.0.3… CVSS 3.1MEDIUM 5.4
  • TI-2024-36770 Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct… CVSS 3.1MEDIUM 5.3
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences