← Vulnerability feed

Vulnerability record · CVE-2024-31991 · published 19 April 2024

CVE-2024-31991: Mealie server-side request forgery (ssrf) vulnerability

Mealie · Mealie

Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safe_scrape_html function utilizes a user-controlled URL to issue a request to a remote server. Based on the content of the response, it will either parse the content or disregard it. This function, nor those that call it, add any restrictions on the URL that can be provided, nor is it restricted to being an FQDN (i.e., an IP address can be provided). As this function’s return will be handled differently by its caller depending on the response, it is possible for an attacker to use this functionality to positively identify HTTP(s) servers on the local network with any IP/port combination. This issue can result in any authenticated user being able to map HTTP servers on a local network that the Mealie service has access to. Note that by default any user can create an account on a Mealie server, and that the default changeme@example.com user is available with its hard-coded password. This vulnerability is fixed in 1.4.0.

3.5 CVSS 3.1 Low EPSS 0.32% · top 77.2% CWE-918 · Server-side request forgery (SSRF)
3.5CVSS 3.1 base score
0.32%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safe_scrape_html function utilizes a user-controlled URL to issue a request to a remote server. Based on the content of the response, it will either parse the content or disregard it. This function, nor those that call it, add any restrictions on the URL that can be provided, nor is it restricted to being an FQDN (i.e., an IP address can be provided). As this function’s return will be handled differently by its caller depending on the response, it is possible for an attacker to use this functionality to positively identify HTTP(s) servers on the local network with any IP/port combination. This issue can result in any authenticated user being able to map HTTP servers on a local network that the Mealie service has access to. Note that by default any user can create an account on a Mealie server, and that the default changeme@example.com user is available with its hard-coded password. This vulnerability is fixed in 1.4.0.

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/mealie-recipes/mealie/blob/mealie-next/mealie/services/scraper/scraper_strategies.py#L27-L70 Product
https://github.com/mealie-recipes/mealie/commit/2a3463b7466bc297aede50046da9550d919ec56f Patch
https://github.com/mealie-recipes/mealie/pull/3368 Issue Tracking
https://securitylab.github.com/advisories/GHSL-2023-225_GHSL-2023-226_Mealie/ Third Party Advisory
https://github.com/mealie-recipes/mealie/blob/mealie-next/mealie/services/scraper/scraper_strategies.py#L27-L70 Product
https://github.com/mealie-recipes/mealie/commit/2a3463b7466bc297aede50046da9550d919ec56f Patch
https://github.com/mealie-recipes/mealie/pull/3368 Issue Tracking
https://securitylab.github.com/advisories/GHSL-2023-225_GHSL-2023-226_Mealie/ Third Party Advisory

Track CVE-2024-31991 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-34615Mealie weak password requirements vulnerabilityMealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-forc…EPSS 1.6%9.0CVE-2025-56795Mealie cross-site scripting vulnerabilityMealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) in the recipe creation functionality. Unsanitized user input in the "note…EPSS 0.36%7.6CVE-2024-55073Mealie missing authorization vulnerabilityA Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their own profi…EPSS 0.31%6.5CVE-2024-31994Mealie uncontrolled resource consumption vulnerabilityMealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, an attacker can point the image request to an arbitrarily large file. Mealie…EPSS 0.28%6.5CVE-2024-31992Mealie uncontrolled resource consumption vulnerabilityMealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safe_scrape_html function utilizes a user-controlled URL to issue a requ…EPSS 0.72%6.5CVE-2022-34621Mealie insecure direct object reference vulnerabilityMealie 1.0.0beta3 was discovered to contain an Insecure Direct Object Reference (IDOR) vulnerability which allows attackers to modify user passwords …EPSS 1.1%6.1CVE-2025-70297Mealie cross-site scripting vulnerabilityA stored cross-site scripting (XSS) vulnerability in the recipe asset upload and media serving component in Mealie 3.3.1 allows remote authenticated …EPSS 0.22%5.9CVE-2022-34624Mealie insufficient session expiration vulnerabilityMealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET…EPSS 0.62%

Source: NIST National Vulnerability Database (record CVE-2024-31991), CISA KEV, FIRST EPSS (scores of 2026-10-13). This page is refreshed as NVD updates the record.