PT-2026-7650 · Git+1 · Mealie

Published 2026-02-11 · Updated 2026-02-23 · CVE-2025-70297

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mealie version 3.3.1

Description A stored cross-site scripting (XSS) issue exists in the recipe asset upload and media serving component. Authenticated remote users can inject arbitrary web script or HTML through an uploaded SVG file. The file is served as image/svg+xml and rendered by a victim’s browser. The affected component handles SVG file uploads and their subsequent delivery as images. The vulnerability allows an attacker to inject malicious code that executes within the context of another user’s browser.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the types of files that can be uploaded to the recipe asset upload component.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-70297

Affected Products

Mealie

References · 5

• 🔥 https://github.com/chrisWalker11/Cves/blob/main/CVE-2025-70297/CVE-2025-70297.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-70297 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-70297 · Security Note
• https://github.com/mealie-recipes/mealie/issues/6319 · Note
• https://t.me/cveNotify/152876 · Telegram Post