CVE-2025-23211: Tandoor Recipes - SSTI - Remote Code Execution
Published Jan 28, 2025
·Updated
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root. This vulnerability is fixed in 1.5.24.
Affected Software
2 affected components
Tandoor Recipes Tandoor Recipes<1.5.24
Tandoor Recipes<1.5.24
Remediation
Event History
Jan 28, 2025
CVE Published
via MITRE·03:24 PM
Data Sourced
via MITRE·03:24 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-23211?
CVE-2025-23211 is classified as a critical vulnerability due to the potential for remote code execution.
2
How do I fix CVE-2025-23211?
To fix CVE-2025-23211, upgrade Tandoor Recipes to version 1.5.24 or later.
3
What type of vulnerability is CVE-2025-23211?
CVE-2025-23211 is a Server-Side Template Injection (SSTI) vulnerability.
4
Who is affected by CVE-2025-23211?
Any user of Tandoor Recipes versions prior to 1.5.24 is affected by CVE-2025-23211.
5
Can CVE-2025-23211 be exploited by unauthenticated users?
Yes, CVE-2025-23211 can be exploited by any user, even those without authentication.