CVE-2025-70296: Command Injection
Published Feb 11, 2026
·Updated
A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary HTML, resulting in user interface redressing within the recipe view.
Affected Software
2 affected components
Mealie
Mealie Mealie>=3.3.1<3.8.0
Event History
Feb 11, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-70296?
CVE-2025-70296 is considered a medium severity vulnerability due to its potential impact on user interface security.
2
How do I fix CVE-2025-70296?
To fix CVE-2025-70296, upgrade Mealie to version 3.8.0 or later.
3
Who is affected by CVE-2025-70296?
CVE-2025-70296 affects remote authenticated users of Mealie versions between 3.3.1 and 3.8.0.
4
What type of vulnerability is CVE-2025-70296?
CVE-2025-70296 is a stored HTML injection vulnerability, allowing for arbitrary HTML injection.
5
What could be the consequences of CVE-2025-70296?
The consequences of CVE-2025-70296 include user interface redressing, which can mislead users and compromise UI integrity.