PT-2026-7650

Name of the Vulnerable Software and Affected Versions Mealie version 3.3.1 Description A stored cross-site scripting XSS issue exists in the recipe asset upload and media serving component. Authenticated remote users can inject arbitrary web script or HTML through an uploaded SVG file. The file i...

CVE-2025-70297

A stored cross-site scripting XSS vulnerability in the recipe asset upload and media serving component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary web script or HTML via an uploaded SVG file that is served as image/svg+xml and rendered by a victim s browser...