What is the CVSS score of CVE-2026-29055?

CVE-2026-29055 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Recipes are affected by CVE-2026-29055?

Organizations using versions should be aware of moderate risk from CVE-2026-29055 rated CVSS 5.3. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-29055?

Within 30 days: Identify affected systems running versions and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Recipes CVE-2026-29055

EUVD-2026-16297 MEDIUM

Exposure of Sensitive Information Through Metadata (CWE-1230)

2026-03-26 GitHub_M

Information Disclosure Recipes

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2.6.0

EUVD ID Assigned

Mar 26, 2026 - 19:16 euvd

EUVD-2026-16297

Analysis Generated

Mar 26, 2026 - 19:16 vuln.today

CVE Published

Mar 26, 2026 - 19:03 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the image processing pipeline in Tandoor Recipes explicitly skips EXIF metadata stripping, image rescaling, and size validation for WebP and GIF image formats. A developer TODO comment in the source code acknowledges this as a known issue. As a result, when users upload recipe photos in WebP format (the default format for modern smartphone cameras), their sensitive EXIF data - including GPS coordinates, camera model, timestamps, and software information - is stored and served to all users who can view the recipe. Version 2.6.0 fixes the issue.

AnalysisAI

Tandoor Recipes versions prior to 2.6.0 fail to strip EXIF metadata from WebP and GIF image uploads, exposing sensitive information such as GPS coordinates, timestamps, and camera details to all users viewing shared recipes. This information disclosure vulnerability affects any user uploading recipe photos, particularly those using modern smartphones that default to WebP format. The vulnerability is fixed in version 2.6.0.

Technical ContextAI

Tandoor Recipes (CPE: cpe:2.3:a:tandoorrecipes:recipes:*:*:*:*:*:*:*:*) implements an image processing pipeline that explicitly bypasses EXIF metadata removal for WebP and GIF formats, as acknowledged by a developer TODO comment in the source code. This reflects a CWE-1230 vulnerability (Improper Handling of Sensitive Information) where the application fails to sanitize metadata before storage and serving. While JPEG and other formats likely receive metadata stripping, WebP (the default output format for modern smartphone cameras) and GIF formats retain all embedded EXIF tags including geolocation, camera EXIF IFD, timestamps, and software identifiers. The metadata is served without restriction to all users with recipe visibility, creating an information disclosure channel.

RemediationAI

Upgrade Tandoor Recipes to version 2.6.0 or later immediately (see vendor release at https://github.com/TandoorRecipes/recipes/releases/tag/2.6.0). Until patching is feasible, restrict recipe visibility via role-based access controls to limit exposure scope, and implement reverse proxy rules to block direct image serving or strip EXIF headers at the HTTP layer using tools such as ImageMagick or custom middleware. Audit existing recipe uploads for sensitive location data and contact affected users if deployments serve recipes from restricted-access locations.