In Tandoor Recipes, an authenticated local file disclosure vulnerability exists in the RecipeImport workflow. The application fails to validate the file_path parameter and does not enforce directory restrictions in the local storage backend. As a result, an attacker with import permissions can craft a file_path that traverses directories to read any file accessible to the application process. This can expose sensitive user data, system configuration files, or crucial service files, which may in turn enable further compromise of the host.

Any installation of the TandoorRecipes:recipes application running a version earlier than 2.5.1. The CVE specifically lists Tandoor Recipes as the affected vendor/product. Users with import permissions are susceptible. The relevant versions that are affected are all releases prior to 2.5.1.

The vulnerability scores a CVSS of 4.9, indicating moderate severity, while the EPSS score remains below 1%, suggesting low probability of exploitation at present. The CVE is not included in CISA’s KEV catalog. Exploitation requires an authenticated session with import privileges; the attacker must log into the application and supply a crafted file_path during recipe import. If successful, the attacker can read arbitrary files and potentially advance to full system compromise.