CVE-2025-23212: Tandoor Recipes - Local file disclosure - Users can read the content of any file on the server
Published Jan 28, 2025
·Updated
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The external storage feature allows any user to enumerate the name and content of files on the server. This vulnerability is fixed in 1.5.28.
Affected Software
2 affected components
Tandoor Recipes Tandoor Recipes<1.5.28
Tandoor Recipes<1.5.28
Remediation
Event History
Jan 28, 2025
CVE Published
via MITRE·03:29 PM
Data Sourced
via MITRE·03:29 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-23212?
The severity of CVE-2025-23212 is considered critical due to the potential exposure of sensitive file names and content.
2
How do I fix CVE-2025-23212?
To fix CVE-2025-23212, update Tandoor Recipes to version 1.5.28 or later.
3
What type of vulnerability is CVE-2025-23212?
CVE-2025-23212 is an exposure vulnerability that allows unauthorized users to enumerate files on the server.
4
Who is affected by CVE-2025-23212?
Users of Tandoor Recipes versions prior to 1.5.28 are affected by CVE-2025-23212.
5
Is there a workaround for CVE-2025-23212?
There are no known workarounds for CVE-2025-23212; updating to the latest version is recommended.