Executive brief
Mealie is a self-hosted recipe manager and meal planner. An attacker can exploit a server-side request forgery (SSRF) vulnerability in the recipe action trigger functionality by manipulating a URL parameter, allowing them to make unauthorized requests from the server to internal resources or external systems. This could lead to information disclosure or unauthorized actions performed on behalf of the server.
Technical details
A server-side request forgery (SSRF) vulnerability exists in the recipe action trigger component, specifically in the payload.model_dump function within controller_group_recipe_actions.py. The vulnerability is triggered by manipulating the url argument without proper validation. The attack is remotely exploitable and requires network access; the vulnerability was patched in version 3.26.0 (commit fb221afa258c8dd2c4ac95b1996c33ef9db3f477).
Affected products
- mealie-recipes Mealie up to 3.25.1
Timeline
- 2026-09-20: disclosed
- 2026-09-04: patched: Version 3.26.0