What is the CVSS score of CVE-2025-23213?

CVE-2025-23213 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Recipes are affected by CVE-2025-23213?

Organizations using Tandoor Recipes face significant risk from CVE-2025-23213, a unrestricted file upload vulnerability rated CVSS 8.7.. A patch is available.

Is there a public PoC exploit available for CVE-2025-23213?

Yes, a public proof-of-concept exploit is available for CVE-2025-23213. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2025-23213?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Review file handling controls and restrict upload directories.

Recipes CVE-2025-23213

HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-01-28 security-advisories@github.com

File Upload XSS Recipes

8.7

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:06 vuln.today

Patch released

Mar 28, 2026 - 18:06 nvd

Patch available

PoC Detected

May 08, 2025 - 18:46 vuln.today

Public exploit code

CVE Published

Jan 28, 2025 - 16:15 nvd

HIGH 8.7

DescriptionNVD

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to upload arbitrary files, including html and svg. Both can contain malicious content (XSS Payloads). This vulnerability is fixed in 1.5.28.

AnalysisAI

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to upload arbitrary files, including html and svg. Both can contain malicious content (XSS Payloads). This vulnerability is fixed in 1.5.28. Affected products include: Tandoor Recipes.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.

CVE-2025-23213 vulnerability details – vuln.today

Back