Server-Side Request Forgery in Tandoor Recipes by Tandoor

CVE-2026-115810

What is CVE-2026-115810?

The application Tandoor Recipes prior to version 2.7.0 contains a server-side request forgery flaw in the Pestle importer functionality. This vulnerability allows authenticated low-privileged users to manipulate the server into issuing GET requests to both internal and external hosts by providing a specially crafted image URL within a Pestle JSON import file. By exploiting this weakness, attackers can bypass existing SSRF protections, enabling potential access to internal endpoints, conducting port and service discovery, and extracting sensitive internal responses through the stored recipe image.

References