CVE-2025-23213: Tandoor Recipes - Stored XSS through Unrestricted File Upload
Published Jan 28, 2025
·Updated
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to upload arbitrary files, including html and svg. Both can contain malicious content (XSS Payloads). This vulnerability is fixed in 1.5.28.
Affected Software
2 affected components
Tandoor Recipes Tandoor Recipes<1.5.28
Tandoor Recipes<1.5.28
Remediation
Event History
Jan 28, 2025
CVE Published
via MITRE·03:31 PM
Data Sourced
via MITRE·03:31 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-23213?
CVE-2025-23213 has a high severity rating due to the potential for XSS attacks via file uploads.
2
How do I fix CVE-2025-23213?
To fix CVE-2025-23213, update Tandoor Recipes to version 1.5.28 or later.
3
What types of files are affected by CVE-2025-23213?
CVE-2025-23213 affects arbitrary files, specifically HTML and SVG files, which can be used for XSS payloads.
4
What is the impact of CVE-2025-23213?
The impact of CVE-2025-23213 includes the possibility of executing malicious scripts in users' browsers through file uploads.
5
Is CVE-2025-23213 present in all versions of Tandoor Recipes?
CVE-2025-23213 is present in Tandoor Recipes versions prior to 1.5.28.