CVE-2022-34625

HIGH

Mealie 1.0.0beta3 - Remote Code Execution via Jinja2 Template Injection

Title source: llm
STIX 2.1

Description

Mealie1.0.0beta3 was discovered to contain a Server-Side Template Injection vulnerability, which allows attackers to execute arbitrary code via a crafted Jinja2 template.

References (5)

Core 5
Core References
Third Party Advisory x_refsource_misc
https://cwe.mitre.org/data/definitions/94.html
Product x_refsource_misc
https://hub.docker.com/r/hkotel/mealie
Release Notes, Vendor Advisory x_refsource_misc
https://docs.mealie.io/changelog/v0.5.6/
Third Party Advisory x_refsource_misc
https://cwe.mitre.org/data/definitions/1336.html
Exploit, Third Party Advisory x_refsource_misc
https://gainsec.com/2022/08/02/cve-2022-34625-ssti-rce-mealie/

Scores

CVSS v3 7.2
EPSS 0.0219
EPSS Percentile 80.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-94
Status published
Products (1)
mealie_project/mealie 1.0.0 beta3
Published Aug 02, 2022
Tracked Since Feb 18, 2026