CVE-2024-55074: Grocy Project Grocy

Critical severity, CVSS 9.0. EPSS: 0.7% chance of exploitation in the next 30 days.

The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370.

Affected products

• Grocy Project Grocy: up to and including 4.3.0

Published 2025-01-06. Last modified 2026-06-17.