Recipes CVE-2026-27460

This vulnerability presents moderate-to-significant real-world risk despite a CVSS score of 6.5 (medium). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates the attack requires network access with low complexity and authenticated privileges-a realistic threat model for Tandoor Recipes, which is typically self-hosted by users who may not scrutinize all imports. The primary impact is availability (A:H), making this a denial-of-service rather than data breach or integrity concern. However, the lack of complexity (AC:L), requirement for valid authentication (PR:L), and the fact that no public exploit or KEV status is reported suggest this is not actively exploited at scale. Real-world risk depends on deployment model: shared instances with multiple users or publicly accessible Tandoor instances present higher risk, whereas personal single-user instances are lower priority. Organizations should prioritize patching if Tandoor is exposed to multiple users or untrusted accounts; however, this is not a critical emergency update.

An authenticated user of a shared or publicly accessible Tandoor Recipes instance crafts a ZIP bomb-a highly compressed file that expands to gigabytes of data-and uploads it through the recipe import functionality. Upon decompression, the server exhausts available memory and CPU resources, causing the application to crash or become unresponsive, denying service to all other legitimate users. This is practical for attackers with valid accounts (e.g., compromised credentials or open registration) and requires no technical exploitation tools beyond standard ZIP bomb generation utilities. No public exploit code has been identified; however, ZIP bombs are trivial to generate using freely available tools, making the practical exploitation barrier very low for authenticated attackers.