CVE-2025-23211criticalCWE-1336

CVE-2025-23211: critical vulnerability in TandoorRecipes recipes

Tandoor Recipes - SSTI - Remote Code Execution

Published

Follow this CVE+ Monitor recipes

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 10epss 3.7%
In short

Tandoor Recipes has a vulnerability that lets any user run dangerous code on the server through a template injection flaw. This can give attackers complete control of the application and the computer running it.

Technical detail

A Jinja2 Server-Side Template Injection (SSTI) vulnerability in Tandoor Recipes allows authenticated or unauthenticated users to inject malicious template code, leading to arbitrary command execution with the privileges of the application process (potentially root in containerized deployments). The vulnerability exists in template processing without proper input sanitization.

Summary generated and translated by AI from the official description.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root. This vulnerability is fixed in 1.5.24.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
TandoorRecipes · recipes
Related CVEs — TandoorRecipes recipes

In the same product, most dangerous first.

CVE-2025-23212HIGHTandoor Recipes - Local file disclosure - Users can read the content of any file on the serverEPSS 0.5%CVE-2026-33152CRITICALTandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthenticationEPSS 0.5%CVE-2026-25964MEDIUMTandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File ReadEPSS 0.5%CVE-2026-33148MEDIUMURL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API KeyEPSS 0.5%CVE-2026-33153HIGHTandoor Recipes's Unauthenticated Debug Parameter Leaks Full Raw SQL Queries Including Schema, Table Names, and Access Control LogicEPSS 0.5%CVE-2026-35488HIGHTandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) usersEPSS 0.4%