CVE-2025-23213CWE-434

Tandoor Recipes - Stored XSS through Unrestricted File Upload

High · published January 28, 2025

CVSS v3.1
8.7
EPSS
0%
Percentile
29.4
In the wild
Unconfirmed
What it is

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to upload arbitrary files, including html and svg. Both can contain malicious content (XSS Payloads). This vulnerability is fixed in 1.5.28.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00367 · 29.4th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-01-28T15:31Z
EPSS history
Timeline
  • 28 JAN 15:31Z
    Tandoor Recipes - Stored XSS through Unrestricted File Upload
    cvelistv5