PatchTheCVEmealie vulnerabilities and fixes
Recent CVEs affecting mealie, with upgrade or downgrade steps. 6 tracked.
mealie has 6 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-02-11. Highest priority: CVE-2025-56795 (score 44/100).
- CVE-2025-70297 MEDIUM 6.1 UPGRADE A stored cross-site scripting (XSS) vulnerability in the recipe asset upload and media serving component in Me
- CVE-2025-70296 MEDIUM 5.4 UPGRADE A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote au
- CVE-2025-56795 CRITICAL 9.0 UPGRADE Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) in the recipe creation functionali
- CVE-2024-55073 HIGH 7.6 DOWNGRADE A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2
- CVE-2024-55072 MEDIUM 5.4 DOWNGRADE A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2
- CVE-2024-55070 LOW 3.1 DOWNGRADE A Broken Object Level Authorization vulnerability in the component /households/permissions of hay-kot mealie v
FAQ
How do I fix mealie vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is mealie being exploited right now?
None of the tracked mealie CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which mealie CVE should I patch first?
CVE-2025-56795 currently ranks highest (44/100): Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) in the recipe creation functionali.