CVE-2026-94028: mealie-recipes Mealie Recipe Action Trigger controller_group_recipe_actions.py payload.model_dump server-side request forgery
A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.modeldump of the file mealie/routes/households/controllergrouprecipeactions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.26.0 is able to address this issue. This patch is called fb221afa258c8dd2c4ac95b1996c33ef9db3f477. The affected component should be upgraded.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mealie-recipes Mealie (Recipe Action Trigger)to a version that resolves this vulnerability.Fixed in 3.26.0Patch fb221afa258c8dd2c4ac95b1996c33ef9db3f477
Event History
Frequently Asked Questions
Which deployments are affected?
Mealie installations up to version 3.25.1 are affected where the Recipe Action Trigger component is present. Version 3.26.0 contains the fix.
What access does an attacker need to exploit this issue?
The issue can be exploited remotely, but the CVSS vector indicates low privileges are required. Exploitation involves manipulating the url argument processed by the Recipe Action Trigger.
Is public exploit information available?
Yes. The supplied data states that an exploit has been made publicly available, increasing the likelihood of attempted exploitation.
What should be done to remediate the vulnerability?
Upgrade the affected Mealie component to version 3.26.0. The remediation is identified as patch fb221afa258c8dd2c4ac95b1996c33ef9db3f477.