CVE-2026-94028CWE-918ssrf

CVE-2026-94028

Medium · published September 20, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
38.2
In the wild
Unconfirmed
What it is

A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.model_dump of the file mealie/routes/households/controller_group_recipe_actions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.26.0 is able to address this issue. This patch is called fb221afa258c8dd2c4ac95b1996c33ef9db3f477. The affected component should be upgraded.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00450 · 38.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-20T17:17Z
References (9)
https://github.com/mealie-recipes/mealie/ · [email protected]https://github.com/mealie-recipes/mealie/commit/fb221afa258c8dd2c4ac95b1996c33ef9db3f477 · [email protected]https://github.com/mealie-recipes/mealie/issues/7831 · [email protected]https://github.com/mealie-recipes/mealie/pull/7914 · [email protected]https://github.com/mealie-recipes/mealie/releases/tag/v3.26.0 · [email protected]https://vuldb.com/cve/CVE-2026-94028 · [email protected]https://vuldb.com/submit/945043 · [email protected]https://vuldb.com/vuln/407957 · [email protected]https://vuldb.com/vuln/407957/cti · [email protected]
EPSS history
Timeline
  • 22 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 20 SEP 13:00Z
    mealie-recipes Mealie Recipe Action Trigger controller_group_recipe_actions.py payload.model_dump server-side request forgery
    cvelistv5