CVE-2025-56795: XSS
Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) in the recipe creation functionality. Unsanitized user input in the "note" and "text" fields of the "/api/recipes/{recipename}" endpoint is rendered in the frontend without proper escaping leading to persistent XSS.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-56795?
CVE-2025-56795 is categorized as a medium severity vulnerability due to its ability to facilitate persistent XSS attacks.
How do I fix CVE-2025-56795?
To fix CVE-2025-56795, upgrade to Mealie version 3.0.2 or later where the XSS vulnerability has been resolved.
What functionality is affected by CVE-2025-56795?
CVE-2025-56795 affects the recipe creation functionality within Mealie, specifically in the note and text fields.
Can CVE-2025-56795 lead to data theft?
Yes, CVE-2025-56795 can potentially lead to data theft by allowing attackers to execute scripts in the context of other users' sessions.
Is user input the cause of CVE-2025-56795?
Yes, CVE-2025-56795 is caused by unsanitized user input being rendered in the frontend without proper escaping.