A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.model_dump of the file mealie/routes/households/controller_group_recipe_actions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side request forgery.
The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.26.0 is able to address this issue.
This patch is called fb221afa258c8dd2c4ac95b1996c33ef9db3f477. The affected component should be upgraded.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
mealie-recipes:mealie
References 9
https://vuldb.com/vuln/407957
VDB-407957 | mealie-recipes Mealie Recipe Action Trigger controller_group_recipe_actions.py payload.model_dump server-side request forgery
https://vuldb.com/vuln/407957/cti
VDB-407957 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/cve/CVE-2026-94028
CVE-2026-94028 | CVE Analysis and Report
https://vuldb.com/submit/945043
Submit #945043 | mealie-recipes mealie commit 642c826 Server-Side Request Forgery
https://github.com/mealie-recipes/mealie/issues/7831
NVD
https://github.com/mealie-recipes/mealie/pull/7914
NVD
https://github.com/mealie-recipes/mealie/commit/fb221afa258c8dd2c4ac95b1996c33e…
NVD
https://github.com/mealie-recipes/mealie/releases/tag/v3.26.0
NVD
https://github.com/mealie-recipes/mealie/
NVD