« Volver al listado

CVE-2026-25964

Estado: AnalizadaMedia (4.9)—

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, a Path Traversal vulnerability in the RecipeImport workflow of Tandoor Recipes allows authenticated users with import permissions to read arbitrary files on the server. This vulnerability stems from a lack of input validation in the file_path parameter and insufficient checks in the Local storage backend, enabling an attacker to bypass storage directory restrictions and access sensitive system files (e.g., /etc/passwd) or application configuration files (e.g., settings.py), potentially leading to full system compromise. This vulnerability is fixed in 2.5.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Tandoor — Recipes

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-25964",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-25964",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-13T20:00:57.599657Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "TandoorRecipes",
          "product": "recipes",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.5.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-13T19:17:28.810",
  "references": [
    {
      "url": "https://github.com/TandoorRecipes/recipes/commit/f7f3524609451ab0b5a4fd760ad0af147d8ed794",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/TandoorRecipes/recipes/releases/tag/2.5.1",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-6485-jr28-52xx",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, a Path Traversal vulnerability in the RecipeImport workflow of Tandoor Recipes allows authenticated users with import permissions to read arbitrary files on the server. This vulnerability stems from a lack of input validation in the file_path parameter and insufficient checks in the Local storage backend, enabling an attacker to bypass storage directory restrictions and access sensitive system files (e.g., /etc/passwd) or application configuration files (e.g., settings.py), potentially leading to full system compromise. This vulnerability is fixed in 2.5.1."
    },
    {
      "lang": "es",
      "value": "Tandoor Recipes es una aplicación para gestionar recetas, planificar comidas y crear listas de la compra. Anteriormente a la 2.5.1, una vulnerabilidad de salto de ruta en el flujo de trabajo RecipeImport de Tandoor Recipes permite a usuarios autenticados con permisos de importación leer archivos arbitrarios en el servidor. Esta vulnerabilidad se debe a una falta de validación de entrada en el parámetro file_path y a comprobaciones insuficientes en el backend de almacenamiento local, lo que permite a un atacante eludir las restricciones del directorio de almacenamiento y acceder a archivos sensibles del sistema (p. ej., / etc/ passwd) o a archivos de configuración de la aplicación (p. ej., settings.py), lo que podría llevar a un compromiso total del sistema. Esta vulnerabilidad se ha corregido en la versión 2.5.1."
    }
  ],
  "lastModified": "2026-06-17T10:25:30.277",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tandoor:recipes:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "21860AB5-9F47-4015-958B-26FE480AE53B",
              "versionEndExcluding": "2.5.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}