CVE-2024-31991: mealie SSRF — Fix

Description

Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safe_scrape_html function utilizes a user-controlled URL to issue a request to a remote server. Based on the content of the response, it will either parse the content or disregard it. This function, nor those that call it, add any restrictions on the URL that can be provided, nor is it restricted to being an FQDN (i.e., an IP address can be provided). As this function’s return will be handled differently by its caller depending on the response, it is possible for an attacker to use this functionality to positively identify HTTP(s) servers on the local network with any IP/port combination. This issue can result in any authenticated user being able to map HTTP servers on a local network that the Mealie service has access to. Note that by default any user can create an account on a Mealie server, and that the default [email protected] user is available with its hard-coded password. This vulnerability is fixed in 1.4.0.

Is your site exposed to CVE-2024-31991?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.1

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Weakness Type (CWE)

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Vendor	Product	Versions
mealie	mealie	< 1.4.0

References

Advisories & Patches

https://github.com/mealie-recipes/mealie/commit/2a3463b7466bc297aede50046da9550d919ec56f https://github.com/mealie-recipes/mealie/commit/2a3463b7466bc297aede50046da9550d919ec56f

Other References

https://github.com/mealie-recipes/mealie/blob/mealie-next/mealie/services/scraper/scraper_strategies.py#L27-L70 https://github.com/mealie-recipes/mealie/pull/3368 https://securitylab.github.com/advisories/GHSL-2023-225_GHSL-2023-226_Mealie/ https://github.com/mealie-recipes/mealie/blob/mealie-next/mealie/services/scraper/scraper_strategies.py#L27-L70 https://github.com/mealie-recipes/mealie/pull/3368 https://securitylab.github.com/advisories/GHSL-2023-225_GHSL-2023-226_Mealie/

Frequently Asked Questions

What is CVE-2024-31991? +

Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safe_scrape_html function utilizes a user-controlled URL to issue a request to a remote server. Based on the content of the response, it will either parse the content or disregard it. This function, nor those that call it, add any restrictions on the URL that can be provided, nor is it restricted to being an FQDN (i.e., an IP address can be provided). As this function’s return will be handled differently by its caller depending on the response, it is possible for an attacker to use this functionality to positively identify HTTP(s) servers on the local network with any IP/port combination. This issue can result in any authenticated user being able to map HTTP servers on a local network that the Mealie service has access to. Note that by default any user can create an account on a Mealie server, and that the default [email protected] user is available with its hard-coded password. This vulnerability is fixed in 1.4.0. It has a CVSS v3.1 base score of 4.1 (MEDIUM).

How severe is CVE-2024-31991? +

CVE-2024-31991 has a CVSS v3.1 score of 4.1 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-31991? +

CVE-2024-31991 affects products from mealie, specifically: mealie. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-31991? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-42336

MaxKB is an open-source AI assistant for enterprise. MaxKB 2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) …

CVE-2026-41682

pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnerable …

CVE-2026-44286

FastGPT is an AI Agent building platform. Prior to version 4.14.17, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows attackers …

CVE-2026-41172

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, an SSRF vulnerability …

CVE-2026-45412

MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.1, SSRF via work_flow_template Import. Authenticated users can supply arbitrary …

CVE-2026-41129

Craft CMS is a content management system (CMS). Versions on the 4.x branch through 4.17.8 and the 5.x branch through …

CVE-2024-31991