CVE-2024-55074 is a high severity (CVSS 8.8) stored cross-site scripting flaw in the Grocy edit profile function, through version 4.3.0, using an uploaded HTML or SVG file. The researcher reports that the maintainer does not plan a fix, so keep Grocy off the internet and limit accounts.
What's affected
The record says Grocy through 4.3.0 is affected, and it is distinct from CVE-2024-8370. The weakness is in the edit profile function, which lets users upload a profile picture.
The researcher write up says users have the permission to edit their own profile by default, and that the upload is not checked for being a harmless image. It also reports that the maintainer said Grocy is a hobby project and not meant for sensitive use, so the issue may not be fixed. Check the Grocy releases yourself for newer versions and notes.
The record lists no fixed version.
How to check if you're exposed
Find your Grocy version in the About dialog or the footer of the web interface. If it is 4.3.0 or earlier, assume it is affected.
Then check where Grocy is reachable. A home instance used by a few trusted people on a local network has far less exposure than one open to the internet with many accounts. List the users who can edit profiles, and look at the uploaded files folder for files that are not images.
What to do now
- Check your Grocy version and review the project release notes for newer versions.
- Keep Grocy off the public internet, or put it behind a VPN or an authenticating reverse proxy.
- Limit accounts to people you trust and remove unused ones.
- Block uploads of HTML and SVG files at the reverse proxy if you can.
- Serve uploaded files from a separate domain or with a restrictive content security policy and a download header.
Why it matters
The weakness is CWE-79 (Cross-site Scripting). The application accepts an uploaded file without checking that it is a picture, so a user can store an HTML or SVG file that contains script. When another user, such as an administrator, opens that file, the script runs in their session with their rights, which is how the record gets to privilege escalation.
Stored XSS is more dangerous than the reflected kind, because the payload waits on the server for a victim. Uploads served from the same site as the application are the usual cause. The record does not flag exploitation, and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-55074.
Quick check
Is there a patch for CVE-2024-55074?
The record lists none, and the researcher reports the maintainer does not plan to fix it. Check the project releases for news.
Does a private home instance need to worry?
Less than an internet facing one, but keep accounts limited and the service off the public internet.
Sources
Last reviewed: 19 October 2026.
