VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Feb 11, 2026· Updated Jun 17, 2026

CVE-2025-70297

CVE-2025-70297

Description

A stored cross-site scripting (XSS) vulnerability in the recipe asset upload and media serving component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary web script or HTML via an uploaded SVG file that is served as image/svg+xml and rendered by a victim s browser.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Mealie/Mealie2 versions
    cpe:2.3:a:mealie:mealie:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:mealie:mealie:*:*:*:*:*:*:*:*range: >=3.3.1,<3.6.0
    • (no CPE)
  • Mealie Recipes/mealiellm-fuzzy
    Range: <3.3.1

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.