CVE-2026-25964: Tandoor Recipes Path Traversal Flaw

CVE-2026-25964 Overview

CVE-2026-25964 is a Path Traversal vulnerability affecting Tandoor Recipes, a popular open-source application for managing recipes, planning meals, and building shopping lists. This vulnerability exists in the RecipeImport workflow and allows authenticated users with import permissions to read arbitrary files on the server. The flaw stems from insufficient input validation in the file_path parameter combined with inadequate security checks in the Local storage backend.

Critical Impact

Authenticated attackers can bypass storage directory restrictions and access sensitive system files such as /etc/passwd or application configuration files like settings.py, potentially leading to full system compromise.

Affected Products

• Tandoor Recipes versions prior to 2.5.1

Discovery Timeline

• February 13, 2026 - CVE CVE-2026-25964 published to NVD
• February 17, 2026 - Last updated in NVD database

Technical Details for CVE-2026-25964

Vulnerability Analysis

This Path Traversal vulnerability (CWE-22) allows authenticated users with recipe import permissions to escape the intended storage directory and read arbitrary files from the server filesystem. The vulnerability requires network access and high privileges (import permissions), but once those conditions are met, an attacker can achieve high confidentiality impact by accessing sensitive configuration files and system data.

The attack surface is exposed through the RecipeImport functionality, where user-controlled file paths are processed without adequate sanitization. This allows directory traversal sequences (such as ../) to be included in file path parameters, enabling access to files outside the designated storage directories.

Root Cause

The root cause of CVE-2026-25964 is twofold: a lack of input validation on the file_path parameter in the RecipeImport workflow, and insufficient security checks within the Local storage backend. The application fails to properly validate and sanitize user-supplied file paths before using them in file system operations, allowing attackers to construct paths that traverse outside the intended storage directory.

Attack Vector

The attack is conducted over the network by an authenticated user who has been granted import permissions within the Tandoor Recipes application. The attacker manipulates the file_path parameter during the recipe import process, injecting directory traversal sequences to access files outside the permitted storage location.

For example, an attacker could craft a malicious import request that references paths like ../../etc/passwd or ../../app/settings.py to read sensitive system configuration and application secrets. This information disclosure could reveal credentials, API keys, database connection strings, and other sensitive data that may lead to further compromise of the system.

The vulnerability mechanism involves the following steps:

1. An authenticated user with import permissions initiates a recipe import
2. The user supplies a crafted file_path parameter containing directory traversal sequences
3. The Local storage backend fails to validate that the resolved path remains within the allowed storage directory
4. The application reads and returns the contents of the attacker-specified file

For detailed technical information, refer to the GitHub Security Advisory GHSA-6485.

Detection Methods for CVE-2026-25964

Indicators of Compromise

• Unusual file access patterns in application logs, particularly requests targeting sensitive system files like /etc/passwd or configuration files
• Import requests containing directory traversal sequences such as ../ or encoded variants
• Access attempts to files outside the designated recipe storage directories
• Unexplained access to settings.py or other application configuration files

Detection Strategies

• Monitor web application logs for import requests containing path traversal patterns (e.g., ../, ..%2f, %2e%2e/)
• Implement file integrity monitoring on sensitive configuration files and system files
• Configure alerting for file access attempts outside designated storage directories
• Review authentication and authorization logs for suspicious activity from users with import permissions

Monitoring Recommendations

• Enable detailed logging for the RecipeImport workflow and file system operations
• Implement real-time alerting for detected path traversal attempts
• Monitor for unauthorized access to sensitive files such as /etc/passwd, settings.py, and database configuration files
• Establish baseline file access patterns to identify anomalous behavior

How to Mitigate CVE-2026-25964

Immediate Actions Required

• Upgrade Tandoor Recipes to version 2.5.1 or later immediately
• Review access control configurations and limit import permissions to trusted users only
• Audit logs for any historical exploitation attempts
• Consider temporarily disabling the recipe import functionality until the patch is applied

Patch Information

Tandoor has released version 2.5.1 which addresses this vulnerability. The fix implements proper input validation and path canonicalization to prevent directory traversal attacks. Organizations should apply this update immediately.

• GitHub Release Version 2.5.1
• GitHub Commit Change
• GitHub Security Advisory GHSA-6485

Workarounds

• Restrict import permissions to only essential, trusted users until the patch can be applied
• Implement network-level access controls to limit who can access the application
• Deploy a Web Application Firewall (WAF) with rules to detect and block path traversal patterns
• Run the Tandoor Recipes application with minimal filesystem permissions to limit the impact of successful exploitation

If immediate patching is not possible, consider implementing additional input validation at the reverse proxy or load balancer level to filter requests containing directory traversal sequences before they reach the application.