Server-Side Request Forgery Vulnerability in TandoorRecipes Disclosed
Article Content
- •CVE-2026-115810 allows SSRF via crafted Pestle imports in TandoorRecipes.
- •Self-hosted instances exposed to the internet are at highest risk.
- •No confirmed active exploitation, but immediate remediation is recommended.
A server-side request forgery (SSRF) vulnerability, identified as CVE-2026-115810, has been disclosed in TandoorRecipes versions before 2.7.0. This flaw allows authenticated low-privileged users to craft malicious image URLs in Pestle JSON import files, enabling the server to issue GET requests to arbitrary internal or external hosts. The vulnerability bypasses the application's SSRF protections, potentially exposing internal services and sensitive data. Self-hosted instances, especially those accessible from the public internet, are particularly at risk. The vulnerability was published on October 23, 2026, with a CVSS score of 6.3, indicating a medium severity. No active exploitation has been confirmed as of now, but remediation is advised for affected systems.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track CVE-2026-115810 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which versions of TandoorRecipes are affected?
What is the risk associated with this vulnerability?
What should I do if I am using TandoorRecipes?
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…