Executive brief
Grocy, a self-hosted grocery and household management application, contains a security flaw in its reporting module. An authorized user can use specially crafted requests to run unauthorized database commands. This could allow an attacker to view sensitive information, modify records, or potentially disrupt the application's operations.
Technical details
A SQL injection vulnerability exists in Bernd Bestel grocy v4.6.0 within the StockReportsController::Spendings component. The application fails to properly sanitize or parameterize the 'product-group' GET parameter when 'group-by=product' is specified, instead concatenating the input directly into a SQL WHERE clause. An authenticated attacker can exploit this by submitting crafted SQL statements to the /stockreports/spendings endpoint. This allows for unauthorized data exfiltration from the SQLite database, including sensitive configuration or user data, and potentially data modification. While the researcher investigated a path to remote code execution via custom includes, only the SQL injection was confirmed in the current environment.
Affected products
- Bernd Bestel grocy 4.6.0
Timeline
- 2026-06-13: disclosed: Initial researcher gist published
- 2026-06-15: advisory: CVE published to NVD