PT-2026-28384 · Unknown · Tandoor Recipes

Liyander · Published 2026-03-26 · Updated 2026-03-26 · CVE-2026-29055

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tandoor Recipes versions prior to 2.6.0

Description The application is designed for managing recipes, planning meals, and creating shopping lists. Prior to version 2.6.0, the image processing pipeline does not remove EXIF metadata, rescale images, or validate image size for WebP and GIF formats. This results in sensitive EXIF data, including GPS coordinates, camera model, timestamps, and software information, being stored and served to all users who can view the recipe when WebP images are uploaded. A developer comment in the source code acknowledges this as a known issue.

Recommendations Update to version 2.6.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-1230

Related Identifiers

CVE-2026-29055

GHSA-9G2J-XCCG-9MHQ

Affected Products

Tandoor Recipes

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29055.json · Exploit
• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-9g2j-xccg-9mhq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29055 · Security Note
• https://osv.dev/vulnerability/CVE-2026-29055 · Vendor Advisory
• https://github.com/TandoorRecipes/recipes/releases/tag/2.6.0 · Note
• https://twitter.com/CVEnew/status/2037280589355901422 · Twitter Post