Mealie
14 CVEs across 1 Mealie products. Browse Mealie vulnerabilities, severities, and proof-of-concept exploits.
Mealie products with known CVEs
Mealie CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2025-70297 | Medium | 6.1 | 2026-02-11 | A stored cross-site scripting (XSS) vulnerability in the recipe asset upload and media serving component in Mealie 3.3.1 allows remote authenticated users to i… |
CVE-2025-70296 | Medium | 5.4 | 2026-02-11 | A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary HTML, resul… |
CVE-2025-56795 | Critical | 9.0 | 2025-09-29 | Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) in the recipe creation functionality. Unsanitized user input in the "note" and "tex… |
CVE-2024-55070 | Low | 3.1 | 2025-03-27 | A Broken Object Level Authorization vulnerability in the component /households/permissions of hay-kot mealie v2.2.0 allows group managers to edit their own per… |
CVE-2024-55073 | High | 7.6 | 2025-03-27 | A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their own profile in orde… |
CVE-2024-55072 | Medium | 5.4 | 2025-03-27 | A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their own profile in orde… |
CVE-2024-31994 | Medium | 6.5 | 2024-04-19 | Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, an attacker can point the image request to an arbitrarily large file. Mealie will atte… |
CVE-2024-31993 | Medium | 6.2 | 2024-04-19 | Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the scrape_image function will retrieve an image based on a user-provided URL, however… |
CVE-2024-31992 | Medium | 6.5 | 2024-04-19 | Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safe_scrape_html function utilizes a user-controlled URL to issue a request to a r… |
CVE-2024-31991 | Medium | 4.1 | 2024-04-19 | Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safe_scrape_html function utilizes a user-controlled URL to issue a request to a r… |
CVE-2022-34624 | Medium | 5.9 | 2022-08-19 | Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET request. |
CVE-2022-34621 | Medium | 6.5 | 2022-08-19 | Mealie 1.0.0beta3 was discovered to contain an Insecure Direct Object Reference (IDOR) vulnerability which allows attackers to modify user passwords and other… |
CVE-2022-34615 | Critical | 9.8 | 2022-08-19 | Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. |
CVE-2022-32425 | Medium | 5.3 | 2022-07-14 | The login function of Mealie v1.0.0beta-2 allows attackers to enumerate existing usernames by timing the server's response time. |