The vulnerability resides in the default configuration of the Tandoor Recipes package managed by NixOS. When SQLite is used with the default MEDIA_ROOT directory, the application places its database file, db.sqlite3, alongside media assets. Because the web server serves media files from this directory, the database file becomes reachable through ordinary HTTP requests, exposing all stored data with no authentication. This is a confidentiality breach described by CWE-538.

The flaw affects the NixOS package collection, specifically the Tandoor Recipes module available from the nixpkgs repository. Versions beginning with 23.05 through 26.04 are vulnerable when using the default configuration. NixOS 26.05 changes the default MEDIA_ROOT to a subdirectory of the data directory, eliminating the issue for configurations whose system.stateVersion is 26.05 or newer. Earlier configurations can mitigate the problem with the recommended workarounds, and a NixOS 25.11 backport exists but requires user action.

The CVSS base score of 8.7 indicates a high impact, while the EPSS score of less than 1% suggests a low probability of exploitation as of the latest data. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote HTTP request to the media directory, retrieving the db.sqlite3 file if the server is configured to serve media files from that location. Once accessed, the database contents could be read by any network adversary with reach to the host.