CVE-2026-115810— Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL
Quick assessment
Affected
TandoorRecipes recipes
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Tandoor Recipes 在 2.7.0 版本之前存在服务端请求伪造（SSRF）漏洞，该漏洞位于 Pestle 导入功能中。经过认证的、权限较低的用户可通过在 Pestle JSON 导入文件中构造恶意的图片 URL，迫使服务器向任意内部或外部主机发起 GET 请求。攻击者可利用 cookbook/integration/pestle.py 文件中未经防护的 requests.get 调用，绕过应用程序中央化的、经过加固的 SSRF 过滤机制，从而访问仅限内部访问的端点、执行端口与服务发现，并通过已存储的食谱
Possible ATT&CK Techniques 3 AI
T1046 · Network Service Discovery T1070 · Indicator Removal T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| TandoorRecipes | recipes | 2.0.0< 2.7.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-115810
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL
Source: CVE Program / CVE List V5
Vulnerability Description
Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external hosts by crafting a malicious image URL in a Pestle JSON import file. Attackers can exploit the raw requests.get call in cookbook/integration/pestle.py, which bypasses the application's centralized requests-hardened SSRF filter, to reach internal-only endpoints, perform port/service discovery, and exfiltrate internal responses via the stored recipe image.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| TandoorRecipes | recipes | 2.0.0 ~ 2.7.0 | - |
|
II. Public POCs for CVE-2026-115810
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-115810
请登录查看更多情报信息。
Other References for CVE-2026-115810 (3)
IV. Related Vulnerabilities
Same product: recipes
-
CVE-2026-59970
Tandoor Recipes: Blind SSRF via AI provider URL (api_base) -
CVE-2026-61726
Tandoor Recipes: Private recipe authorization bypass via /ap -
CVE-2026-59966
Tandoor Recipes: ReDoS (Regular Expression Denial of Service -
CVE-2026-59963
Tandoor Recipes: Private recipe file and share-link authoriz -
CVE-2026-59962
Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in
Same vendor: TandoorRecipes
-
CVE-2026-59970
Tandoor Recipes: Blind SSRF via AI provider URL (api_base) -
CVE-2026-61726
Tandoor Recipes: Private recipe authorization bypass via /ap -
CVE-2026-59966
Tandoor Recipes: ReDoS (Regular Expression Denial of Service -
CVE-2026-59963
Tandoor Recipes: Private recipe file and share-link authoriz -
CVE-2026-59962
Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in
Same weakness: CWE-918
-
CVE-2026-115813
Server-side request forgery in the model download path in Am -
CVE-2026-115752
Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Sto -
CVE-2026-115729
@pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch -
CVE-2026-55190
Event Schedule Vulnerable to SSRF: isUrlSafe() bypassable vi -
CVE-2026-19678
Server-Side Request Forgery (SSRF) Leading to Internal Solr
V. Comments for CVE-2026-115810
No comments yet