CVE-2024-55074

Name of the Vulnerable Software and Affected Versions Grocy versions prior to 4.3.0

Description The issue in the edit profile function of Grocy allows stored Cross Site Scripting (XSS) and resultant privilege escalation by uploading a crafted HTML or SVG file.

Recommendations For versions prior to 4.3.0, update to version 4.3.0 or later to resolve the issue. As a temporary workaround, consider disabling the edit profile function until a patch is available. Restrict access to uploading HTML or SVG files to minimize the risk of exploitation.