Tandoor Recipes - Stored XSS through Unrestricted File Upload
No sign of exploitation. No public exploitation artifact known so far.
Tandoor Recipes allows users to upload files without proper restrictions, letting attackers upload HTML or SVG files containing malicious scripts. When other users view these files, the scripts execute in their browsers, potentially stealing data or taking unauthorized actions.
CWE-434 unrestricted file upload vulnerability in Tandoor Recipes permits uploading HTML and SVG files containing XSS payloads. When served or displayed to other users, these files execute arbitrary JavaScript in the victim's browser context, enabling session hijacking, credential theft, or account compromise. The vulnerability is mitigated in version 1.5.28 through file type validation and content filtering.