Tandoor Recipes versions earlier than 2.6.0 allow a user to inject raw URL parameters into the FDC (FoodData Central) search endpoint by including ampersand characters in the query string. This uncontrolled interpolation enables an attacker to override the embedded API key, alter the upstream query logic, and send malformed requests that cause the server to crash with a 500 error, resulting in a denial of service condition. The flaw is categorized as a URL Parameter Injection weakness.

The affected product is TandoorRecipes:recipes. All deployments running any version prior to 2.6.0 are vulnerable. The vulnerability is mitigated when the application is upgraded to version 2.6.0 or later, which applies proper URL encoding to the query parameter.

The CVSS base score of 6.5 indicates a moderate risk, and the EPSS score of less than 1% suggests exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by crafting HTTP requests to the search endpoint with injected parameters; no user authentication or privileged access is required, so any network-visible client can trigger the crash. The vulnerability does not provide an attacker with code execution or data exfiltration capability beyond the ability to incapacitate the service.