CVE-2022-23071: Tandoor Recipes

Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days.

In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” functionality. When an attacker enters the localhost URL, a low privileged attacker can access/read the internal file system to access sensitive information.

Affected products

• Tandoor Recipes: from 0.9.1, up to and including 1.2.5

Published 2022-06-19. Last modified 2026-06-17.