VulnerabilityAnalyzed

CVE-2025-23213

The file upload feature allows to upload arbitrary files, including html and svg.

MEDIUM 5.4EPSS 0.37%

Does this matter?

Lower severity and a low EPSS score (0.37%). Track it; it rarely justifies an emergency change on its own.

Description

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to upload arbitrary files, including html and svg. Both can contain malicious content (XSS Payloads). This vulnerability is fixed in 1.5.28.

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.37% probability · 30th percentile
CISA KEV: Not listed
Weakness: CWE-434
Affected: tandoor/recipes
Source: security-advisories@github.com

References

https://github.com/TandoorRecipes/recipes/commit/3e37d11c6a3841a00eb27670d1d003f1a713e1cfPatch
https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-56jp-j3x5-hh2wExploit, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.