Mealie-Recipes Mealie
7 CVEs affecting Mealie-Recipes Mealie. Latest disclosed: 2026-09-20. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-31994 | Medium | 6.5 | 2024-04-19 | Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, an attacker can point the image request to an arbitrarily large file. Mealie will atte… |
CVE-2024-31992 | Medium | 6.5 | 2024-04-19 | Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safe_scrape_html function utilizes a user-controlled URL to issue a request to a r… |
CVE-2024-31993 | Medium | 6.2 | 2024-04-19 | Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the scrape_image function will retrieve an image based on a user-provided URL, however… |
CVE-2026-71210 | Medium | 5.3 | 2026-08-05 | Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules… |
CVE-2026-94028 | Medium | 4.3 | 2026-09-20 | A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.model_dump of the file mealie/routes/households/controll… |
CVE-2026-93736 | Medium | 4.3 | 2026-09-18 | Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated attackers to read any user's recipe rating… |
CVE-2024-31991 | Medium | 4.1 | 2024-04-19 | Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safe_scrape_html function utilizes a user-controlled URL to issue a request to a r… |