CVE-2026-27460: Tandoor Recipes Affected by Denial of Service via Recipe Import
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.5, a critical Denial of Service (DoS) vulnerability was in the recipe import functionality. This vulnerability allows an authenticated user to crash the server or make a significantly degrade its performance by uploading a large size ZIP file (ZIP Bomb). This vulnerability is fixed in 2.6.5.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27460?
CVE-2026-27460 is classified as a critical Denial of Service (DoS) vulnerability.
How do I fix CVE-2026-27460?
To fix CVE-2026-27460, upgrade Tandoor Recipes to version 2.6.5 or later.
Which versions of Tandoor Recipes are affected by CVE-2026-27460?
CVE-2026-27460 affects all versions of Tandoor Recipes prior to version 2.6.5.
What kind of attack can exploit CVE-2026-27460?
CVE-2026-27460 can be exploited to perform a Denial of Service attack via the recipe import functionality.
Is there a workaround for CVE-2026-27460?
There is no recommended workaround for CVE-2026-27460; the best course of action is to update the software.