File Enumeration Vulnerability in Tandoor Recipes Application
CVE-2025-23212

6.5MEDIUM

Key Information:

Vendor

Tandoorrecipes

Status
Recipes
Vendor
CVE Published:
28 January 2025

What is CVE-2025-23212?

The Tandoor Recipes application, designed for recipe management, meal planning, and shopping list creation, has a vulnerability that allows any user to enumerate the names and contents of files stored on the server. This breach of data confidentiality can lead to unauthorized access to potentially sensitive information. The issue was rectified in version 1.5.28.

Affected Version(s)

recipes < 1.5.28

References

https://github.com/TandoorRecipes/recipes/security/adviso...
x_refsource_CONFIRM
https://github.com/TandoorRecipes/recipes/commit/36e83a9d...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.