Grocy project — Vulnerabilities & Security Advisories 3

Grocy is a self-hosted grocery and household management system designed for inventory tracking, shopping list organization, and recipe management. Historically, the project has been susceptible to multiple remote code execution vulnerabilities, cross-site scripting flaws, and privilege escalation issues, with three CVEs currently documented. While no major security incidents have been widely reported, the presence of RCE vulnerabilities in past versions highlights potential risks for self-hosted deployments. Users are advised to maintain updated installations to mitigate known security exposures, as the project's web interface and API endpoints have previously been entry points for unauthorized access and system compromise.