CVE-2025-23211 CRITICAL

CVE-2025-23211: Tandoor Recipes - SSTI - Remote Code Execution

Vendor Tandoorrecipes

Product recipes

Weakness CWE-1336

Published January 28, 2025

Last update January 28, 2025

View on NVD All CVEs

CVSS base score

10.0/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root. This vulnerability is fixed in 1.5.24.

Key dates

02Disclosure timeline

January 28, 2025 CVE published

January 28, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-23211 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1336.html

Related vulnerabilities

04Related CVE

CVE-2026-25526 JinJava Bypass through ForTag leads to Arbitrary Java Execution CVE-2025-57811 Craft Potential Remote Code Execution via Twig SSTI CVE-2026-3714 OpenCart Incomplete Fix CVE-2024-36694 template.php save special elements used in a template engine CVE-2025-49142 Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating CVE-2022-0944 Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad