A vulnerability classified as problematic was found in Grocy up to 4.2.0. This vulnerability affects unknown code of the file /api/files/recipepictures/ of the component SVG File Upload Handler. The manipulation of the argument force_serve_as with the input
picture' leads to cross site scripting.
This vulnerability was named CVE-2024-8370. The attack can be initiated remotely. Furthermore, there is an exploit available.
The real existence of this vulnerability is still doubted at the moment. The project maintainer explains that “this is ‘nonsense’ and practically irrelevant according to the project’s security policy” which expects additional authentication for the software.
