CVE-2026-29055 Details
Description
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the image processing pipeline in Tandoor Recipes explicitly skips EXIF metadata stripping, image rescaling, and size validation for WebP and GIF image formats. A developer TODO comment in the source code acknowledges this as a known issue. As a result, when users upload recipe photos in WebP format (the default format for modern smartphone cameras), their sensitive EXIF data — including GPS coordinates, camera model, timestamps, and software information — is stored and served to all users who can view the recipe. Version 2.6.0 fixes the issue.
A privacy vulnerability exists in Tandoor Recipes versions prior to 2.6.0, where the image processing pipeline fails to strip EXIF metadata, validate image sizes, and properly resize WebP and GIF images. This oversight allows sensitive EXIF data, including GPS coordinates, camera details, timestamps, and software information, to be stored and shared with users viewing the recipe. The issue arises because the application bypasses essential metadata checks for these image formats, leaving personal information exposed.
Users can update to Tandoor Recipes version 2.6.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/TandoorRecipes/recipes/releases/tag/2.6.0 | [email protected] | Release Notes |
| https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-9g2j-xccg-9mhq | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1230 | Exposure of Sensitive Information Through Metadata | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tandoor recipes | < 2.6.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 30, 2026 | Initial Analysis | [email protected] |
| Mar 26, 2026 | New CVE Received | [email protected] |