The Cookmate recipe import feature in Tandoor Recipes permits a blind server‑side request forgery because the application does not validate the final destination URL after HTTP redirects. Any authenticated user, even a standard user without administrative rights, can force the server to send requests to arbitrary internal or external resources. This flaw can be used to probe internal network ports, capture cloud instance metadata services such as AWS or GCP metadata, or reveal the host’s real IP address. The vulnerability falls under CWE‑918, representing an unvalidated redirect or forwarding flaw that compromises confidentiality and availability of internal resources.

All releases of Tandoor Recipes prior to version 2.5.1 are affected. The fix was introduced in the 2.5.1 release (see the commit fdf22c5e745740db1fec29d6b4bd3df5d340e6ab and the 2.5.1 tag). Users running any earlier 2.x series, or earlier, are vulnerable.

The CVSS v3.1 score is 7.7, indicating a high severity impact. The EPSS score is reported as less than 1%, suggesting a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated to the application, but once logged in they can supply any URL for import, making the attack path straightforward. The potential damage includes unauthorized network reconnaissance, metadata theft, and server IP disclosure, which could aid further attacks against the host.