CVE-2025-23213

5.4 mediumEPSS 0.4%

Medium (5.4) in tandoor recipes. EPSS 0.4% chance of exploitation in the next 30 days.

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to upload arbitrary files, including html and svg. Both can contain malicious content (XSS Payloads). This vulnerability is fixed in 1.5.28.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2025-01-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

tandoor:recipes

References

https://github.com/TandoorRecipes/recipes/commit/3e37d11c6a3841a00eb27670d1d003f1a713e1cf
https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-56jp-j3x5-hh2w

Check your stack JSON