PT-2026-8022 · Unknown · Tandoor Recipes

Drkim-Dev · Published 2026-02-13 · Updated 2026-02-13 · CVE-2026-25964

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tandoor Recipes versions prior to 2.5.1

Description Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A path traversal flaw exists in the RecipeImport workflow. This issue is due to inadequate input validation of the file path parameter and insufficient checks within the Local storage backend. This allows authenticated users with import permissions to read arbitrary files on the server, potentially including sensitive system files like /etc/passwd or application configuration files such as settings.py, which could lead to a full system compromise.

Recommendations Update Tandoor Recipes to version 2.5.1.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-73

CWE-22

Related Identifiers

CVE-2026-25964

GHSA-6485-JR28-52XX

Affected Products

Tandoor Recipes

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25964.json · Exploit
• https://github.com/TandoorRecipes/recipes/commit/f7f3524609451ab0b5a4fd760ad0af147d8ed794 · Patch
• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-6485-jr28-52xx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25964 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25964 · Security Note
• https://github.com/TandoorRecipes/recipes/releases/tag/2.5.1 · Note
• https://t.me/CVEtracker/44641 · Telegram Post
• https://twitter.com/CVEnew/status/2022387979667542521 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2022409863347732673 · Twitter Post