{"id":"CVE-2026-25964","aliases":["EUVD-2026-5929","GHSA-6485-jr28-52xx"],"status":"published","title":"Tandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File Read","description":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, a Path Traversal vulnerability in the RecipeImport workflow of Tandoor Recipes allows authenticated users with import permissions to read arbitrary files on the server. This vulnerability stems from a lack of input validation in the file_path parameter and insufficient checks in the Local storage backend, enabling an attacker to bypass storage directory restrictions and access sensitive system files (e.g., /etc/passwd) or application configuration files (e.g., settings.py), potentially leading to full system compromise. This vulnerability is fixed in 2.5.1.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00499,"percentile":0.43068,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-22","CWE-73"],"published":"2026-02-13T18:27:08Z","modified":"2026-10-28T02:30:30Z","exploits":[{"source":"pocgithub","id":"drkim-dev/CVE-2026-25964","title":"drkim-dev/CVE-2026-25964","date":"2026-02-17","url":"https://github.com/drkim-dev/CVE-2026-25964"}],"products":[{"vendor":"tandoor","product":"recipes"},{"vendor":"tandoorrecipes","product":"recipes"}],"references":[{"url":"https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-6485-jr28-52xx","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory"]},{"url":"https://github.com/TandoorRecipes/recipes/commit/f7f3524609451ab0b5a4fd760ad0af147d8ed794","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/TandoorRecipes/recipes/releases/tag/2.5.1","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25964.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25964","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-25964","title":"Tandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File Read","description":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, a Path Traversal vulnerability in the RecipeImport workflow of Tandoor Recipes allows authenticated users with import permissions to read arbitrary files on the server. This vulnerability stems from a lack of input validation in the file_path parameter and insufficient checks in the Local storage backend, enabling an attacker to bypass storage directory restrictions and access sensitive system files (e.g., /etc/passwd) or application configuration files (e.g., settings.py), potentially leading to full system compromise. This vulnerability is fixed in 2.5.1.","status":"published","published":"2026-02-13T18:27:08.973Z","modified":"2026-02-13T20:01:40.545Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22","CWE-73"],"updated_at":"2026-11-02T13:41:19.694734Z"}],"euvd":[{"id":"EUVD-2026-5929","description":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, a Path Traversal vulnerability in the RecipeImport workflow of Tandoor Recipes allows authenticated users with import permissions to read arbitrary files on the server. This vulnerability stems from a lack of input validation in the file_path parameter and insufficient checks in the Local storage backend, enabling an attacker to bypass storage directory restrictions and access sensitive system files (e.g., /etc/passwd) or application configuration files (e.g., settings.py), potentially leading to full system compromise. This vulnerability is fixed in 2.5.1.","status":"published","published":"2026-02-13T18:27:08Z","modified":"2026-02-13T20:01:40Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:38.489604Z"}],"nvd":[{"id":"CVE-2026-25964","description":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, a Path Traversal vulnerability in the RecipeImport workflow of Tandoor Recipes allows authenticated users with import permissions to read arbitrary files on the server. This vulnerability stems from a lack of input validation in the file_path parameter and insufficient checks in the Local storage backend, enabling an attacker to bypass storage directory restrictions and access sensitive system files (e.g., /etc/passwd) or application configuration files (e.g., settings.py), potentially leading to full system compromise. This vulnerability is fixed in 2.5.1.","status":"published","published":"2026-02-13T19:17:28.81Z","modified":"2026-06-17T10:25:30.277Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22","CWE-73"],"updated_at":"2026-11-02T14:12:05.908608Z"}],"osv":[{"id":"CVE-2026-25964","title":"Tandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File Read","description":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, a Path Traversal vulnerability in the RecipeImport workflow of Tandoor Recipes allows authenticated users with import permissions to read arbitrary files on the server. This vulnerability stems from a lack of input validation in the file_path parameter and insufficient checks in the Local storage backend, enabling an attacker to bypass storage directory restrictions and access sensitive system files (e.g., /etc/passwd) or application configuration files (e.g., settings.py), potentially leading to full system compromise. This vulnerability is fixed in 2.5.1.","status":"published","published":"2026-02-13T18:27:08.973Z","modified":"2026-10-28T02:30:30.332602797Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22","CWE-73"],"updated_at":"2026-11-02T15:44:59.80315Z"}]}}