Medium severity · published Jan 28, 2025
CVE-2025-23213
Tandoor Recipes - Stored XSS through Unrestricted File Upload
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to upload arbitrary files, including html and svg. Both can contain malicious content (XSS Payloads). This vulnerability is fixed in 1.5.28.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
recipes · TandoorRecipes
< 1.5.28 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-23213
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-23213
Patch
https://github.com/TandoorRecipes/recipes/commit/3e37d11c6a3841a00eb27670d1d003f1a713e1cf
Exploit
https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-56jp-j3x5-hh2w
More from recipes
9.9
CVE-2025-23211
Tandoor Recipes - SSTI - Remote Code Execution
8.1
CVE-2026-61726
Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content
8.1
CVE-2026-35488
Tandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users
8.1
CVE-2026-35045
Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification
8.1
CVE-2026-33149
Tandoor Recipes Vulnerable to Host Header Injection