CVE-2025-70297

A stored cross-site scripting XSS vulnerability in the recipe asset upload and media serving component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary web script or HTML via an uploaded SVG file that is served as image/svg+xml and rendered by a victim s browser...

CVE-2025-70297

A stored cross-site scripting XSS vulnerability in the recipe asset upload and media serving component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary web script or HTML via an uploaded SVG file that is served as image/svg+xml and rendered by a victim s browser...

PT-2026-7650

Name of the Vulnerable Software and Affected Versions Mealie version 3.3.1 Description A stored cross-site scripting XSS issue exists in the recipe asset upload and media serving component. Authenticated remote users can inject arbitrary web script or HTML through an uploaded SVG file. The file i...

CVE-2025-70297

Mealie version 3.3.1 contains a stored cross-site scripting (XSS) vulnerability in the recipe asset upload and media serving component. This flaw allows remote authenticated users to inject arbitrary web script or HTML by uploading a malicious SVG file . The system serves the file as image/svg+xm...

CVE-2025-70297

A stored cross-site scripting XSS vulnerability in the recipe asset upload and media serving component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary web script or HTML via an uploaded SVG file that is served as image/svg+xml and rendered by a victim s browser...

CVE-2025-70297

A stored cross-site scripting XSS vulnerability in the recipe asset upload and media serving component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary web script or HTML via an uploaded SVG file that is served as image/svg+xml and rendered by a victim s browser...

GHSA-H454-RQ3M-89RC Wagtail CRX CodeRed Extensions vulnerable to Path Traversal

views.py in Wagtail CRX CodeRed Extensions formerly CodeRed CMS or coderedcms before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media...