Tandoorrecipes Recipes vulnerabilities

CVE-2025-23211 [CRITICAL] CWE-1336 CVE-2025-23211: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root. This vulnerability is fixed in 1.5.24.

CVE-2026-33152 [HIGH] CWE-307 CVE-2026-33152: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, Tandoor Recipes configures Django REST Framework with BasicAuthentication as one of the default authentication backends. The AllAuth rate limiting configuration (ACCOUNT_RATE_LIMITS: login: 5/m/ip) only applies to the HTML-b

CVE-2026-35045 [HIGH] CWE-639 CVE-2026-35045: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the PUT /api/recipe/batch_update/ endpoint in Tandoor Recipes allows any authenticated user within a Space to modify any recipe in that Space, including recipes marked as private by other users. This bypasses all object-level authorizat

CVE-2026-25991 [HIGH] CWE-918 CVE-2026-25991: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, there is a Blind Server-Side Request Forgery (SSRF) vulnerability in the Cookmate recipe import feature of Tandoor Recipes. The application fails to validate the destination URL after following HTTP redirects, allowing any authenticated

CVE-2026-35488 [HIGH] CWE-749 CVE-2026-35488: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewSet use CustomIsShared as an alternative permission class, but CustomIsShared.has_object_permission() returns True for all HTTP methods — including DELETE, PUT, and PATCH — without checking reque

CVE-2026-33149 [HIGH] CWE-644 CVE-2026-33149: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Versions up to and including 2.5.3 set ALLOWED_HOSTS = '*' by default, which causes Django to accept any value in the HTTP Host header without validation. The application uses request.build_absolute_uri() to generate absolute URLs in multiple contexts,

CVE-2026-35489 [HIGH] CWE-639 CVE-2026-35489: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/{id}/shopping/ endpoint reads amount and unit directly from request.data and passes them without validation to ShoppingListEntry.objects.create(). Invalid amount values (non-numeric strings) cause an unhandled excepti

CVE-2026-33153 [MEDIUM] CWE-89 CVE-2026-33153: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the Recipe API endpoint exposes a hidden `?debug=true` query parameter that returns the complete raw SQL query being executed, including all table names, column names, JOIN relationships, WHERE conditions (revealing access

CVE-2026-28503 [MEDIUM] CWE-639 CVE-2026-28503: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the `SyncViewSet.query_synced_folder()` action in `cookbook/views/api.py` (line 903) fetches a Sync object using `get_object_or_404(Sync, pk=pk)` without including `space=request.space` in the filter. This allows an admin

CVE-2026-33148 [MEDIUM] CWE-74 CVE-2026-33148: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the FDC (USDA FoodData Central) search endpoint constructs an upstream API URL by directly interpolating the user-supplied `query` parameter into the URL string without URL-encoding. An attacker can inject additional URL pa

CVE-2025-23212 [MEDIUM] CWE-200 CVE-2025-23212: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The external storage feature allows any user to enumerate the name and content of files on the server. This vulnerability is fixed in 1.5.28.

CVE-2026-27460 [MEDIUM] CWE-409 CVE-2026-27460: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.5, a critical Denial of Service (DoS) vulnerability was in the recipe import functionality. This vulnerability allows an authenticated user to crash the server or make a significantly degrade its performance by uploading a large size ZIP

CVE-2026-25964 [MEDIUM] CWE-22 CVE-2026-25964: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, a Path Traversal vulnerability in the RecipeImport workflow of Tandoor Recipes allows authenticated users with import permissions to read arbitrary files on the server. This vulnerability stems from a lack of input validation in the fi

CVE-2026-35046 [MEDIUM] CWE-79 CVE-2026-35046: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, Tandoor Recipes allows authenticated users to inject arbitrary tags into recipe step instructions. The bleach.clean() sanitizer explicitly whitelists the tag, causing the backend to persist and serve unsanitized CSS payloads via the AP

CVE-2026-29055 [MEDIUM] CWE-1230 CVE-2026-29055: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the image processing pipeline in Tandoor Recipes explicitly skips EXIF metadata stripping, image rescaling, and size validation for WebP and GIF image formats. A developer TODO comment in the source code acknowledges this

CVE-2025-23213 [MEDIUM] CWE-434 CVE-2025-23213: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to upload arbitrary files, including html and svg. Both can contain malicious content (XSS Payloads). This vulnerability is fixed in 1.5.28.