PT-2026-28384 · Unknown · Tandoor Recipes

Liyander · Publicado 2026-03-26 · Atualizado 2026-03-26 · CVE-2026-29055

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tandoor Recipes versions prior to 2.6.0

Description The application is designed for managing recipes, planning meals, and creating shopping lists. Prior to version 2.6.0, the image processing pipeline does not remove EXIF metadata, rescale images, or validate image size for WebP and GIF formats. This results in sensitive EXIF data, including GPS coordinates, camera model, timestamps, and software information, being stored and served to all users who can view the recipe when WebP images are uploaded. A developer comment in the source code acknowledges this as a known issue.

Recommendations Update to version 2.6.0 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-1230

Identificadores relacionados

CVE-2026-29055

GHSA-9G2J-XCCG-9MHQ

Produtos afetados

Tandoor Recipes

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29055.json · Exploit
• https://github.com/TandoorRecipes/recipes/releases/tag/2.6.0 · Nota
• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-9g2j-xccg-9mhq · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2037280589355901422 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-29055 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-29055 · Aviso do Fabricante