PT-2026-8022 · Unknown · Tandoor Recipes

Drkim-Dev · Publicado 2026-02-13 · Atualizado 2026-02-13 · CVE-2026-25964

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tandoor Recipes versions prior to 2.5.1

Description Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A path traversal flaw exists in the RecipeImport workflow. This issue is due to inadequate input validation of the file path parameter and insufficient checks within the Local storage backend. This allows authenticated users with import permissions to read arbitrary files on the server, potentially including sensitive system files like /etc/passwd or application configuration files such as settings.py, which could lead to a full system compromise.

Recommendations Update Tandoor Recipes to version 2.5.1.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-73

CWE-22

Identificadores relacionados

CVE-2026-25964

GHSA-6485-JR28-52XX

Produtos afetados

Tandoor Recipes

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25964.json · Exploit
• https://github.com/TandoorRecipes/recipes/commit/f7f3524609451ab0b5a4fd760ad0af147d8ed794 · Correção
• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-6485-jr28-52xx · Aviso do Fabricante
• https://github.com/TandoorRecipes/recipes/releases/tag/2.5.1 · Nota
• https://t.me/CVEtracker/44641 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2022387979667542521 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-25964 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2022409863347732673 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-25964 · Nota de Segurança