CVE-2026-71236 [HIGH] – Grocy’s API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilter

Grocy’s API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing <, >, and & back to , and & immediately after purification.