CVE-2025-23212: high-severity vulnerability in TandoorRecipes recipes
Tandoor Recipes - Local file disclosure - Users can read the content of any file on the server
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Tandoor Recipes has a flaw that lets users read any file stored on the server through its external storage feature. This exposes sensitive information like configuration files and private data that should be protected.
The external storage feature in Tandoor Recipes fails to properly restrict file access, allowing authenticated or unauthenticated users to enumerate and retrieve arbitrary files from the server filesystem. The vulnerability stems from insufficient access controls on file retrieval operations, enabling information disclosure of potentially sensitive server data. Fixed in version 1.5.28.
In the same product, most dangerous first.