PT-2026-3477 · Sqlite+5 · Sqlite+5

Nixos-Discourse · Published 2026-01-19 · Updated 2026-01-19 · CVE-2026-23838

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Tandoor Recipes versions 23.05 through 26.05

Description Tandoor Recipes is a recipe manager that, when installed with the Nix package manager and using the default configuration with SQLite and the default MEDIA ROOT, may allow external access to the full database file, potentially on the Internet. This occurs because the NixOS module configures the working directory and the MEDIA ROOT value to /var/lib/tandoor-recipes, leading to the creation of the db.sqlite3 database file in a publicly accessible directory through HTTP, especially when GUNICORN MEDIA=1 is enabled or when using a web server like nginx to serve media files.

Recommendations Versions prior to 26.05 should move MEDIA ROOT into a subdirectory.

Exploit

Fix

Weakness Enumeration

CWE-538

Related Identifiers

CVE-2026-23838

GHSA-G8W3-P77X-MMXH

Affected Products

Unicorn

Nix

Nixos

Sqlite

Tandoor Recipes

Nginx

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23838.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-23838 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23838 · Security Note
• https://github.com/NixOS/nixpkgs/issues/338339 · Note
• https://github.com/NixOS/nixpkgs/security/advisories/GHSA-g8w3-p77x-mmxh · Note
• https://github.com/NixOS/nixpkgs/pull/427845 · Note
• https://github.com/NixOS/nixpkgs/pull/481140 · Note
• https://twitter.com/CVEnew/status/2013316901456286157 · Twitter Post