CVE-2025-23213

Published: Jan 28, 2025Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to upload arbitrary files, including html and svg. Both can contain malicious content (XSS Payloads). This vulnerability is fixed in 1.5.28.

Affected (1)

Products: Tandoor: Recipes

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Tandoor Recipes	Before 1.5.28

Related CWEs

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (2)

https://github.com/TandoorRecipes/recipes/commit/3e37d11c6a3841a00eb27670d1d003f1a713e1cf

Source: security-advisories@github.com

Patch

https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-56jp-j3x5-hh2w

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.