CVE-2026-29055: CWE-1230: Exposure of Sensitive Information Through Metadata in TandoorRecipes recipes
Tandoor Recipes versions prior to 2. 6. 0 do not strip EXIF metadata from uploaded WebP and GIF images. This leads to exposure of sensitive information such as GPS coordinates, camera model, timestamps, and software details to any user who can view the recipe images. The issue is fixed in version 2. 6. 0.
AI Analysis
Technical Summary
The vulnerability CVE-2026-29055 in Tandoor Recipes (versions before 2.6.0) arises because the image processing pipeline explicitly skips stripping EXIF metadata, image rescaling, and size validation for WebP and GIF formats. As a result, sensitive metadata embedded in images, including geolocation and device information, is exposed to all users with access to the recipe images. This is a known issue acknowledged by a developer comment and is addressed in version 2.6.0.
Potential Impact
Sensitive user information embedded in image metadata such as GPS coordinates, camera model, timestamps, and software details can be accessed by any user viewing the affected recipe images. This exposure can lead to privacy violations but does not affect data integrity or availability.
Mitigation Recommendations
Upgrade Tandoor Recipes to version 2.6.0 or later, where the issue is fixed by properly stripping EXIF metadata from WebP and GIF images. No other mitigation is required as the fix is available in the official release.
CVE-2026-29055: CWE-1230: Exposure of Sensitive Information Through Metadata in TandoorRecipes recipes
Description
Tandoor Recipes versions prior to 2. 6. 0 do not strip EXIF metadata from uploaded WebP and GIF images. This leads to exposure of sensitive information such as GPS coordinates, camera model, timestamps, and software details to any user who can view the recipe images. The issue is fixed in version 2. 6. 0.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-29055 in Tandoor Recipes (versions before 2.6.0) arises because the image processing pipeline explicitly skips stripping EXIF metadata, image rescaling, and size validation for WebP and GIF formats. As a result, sensitive metadata embedded in images, including geolocation and device information, is exposed to all users with access to the recipe images. This is a known issue acknowledged by a developer comment and is addressed in version 2.6.0.
Potential Impact
Sensitive user information embedded in image metadata such as GPS coordinates, camera model, timestamps, and software details can be accessed by any user viewing the affected recipe images. This exposure can lead to privacy violations but does not affect data integrity or availability.
Mitigation Recommendations
Upgrade Tandoor Recipes to version 2.6.0 or later, where the issue is fixed by properly stripping EXIF metadata from WebP and GIF images. No other mitigation is required as the fix is available in the official release.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-03T17:50:11.244Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 69c589313c064ed76fb167bb
Added to database: 3/26/2026, 7:29:53 PM
Last enriched: 4/3/2026, 1:35:05 PM
Last updated: 5/11/2026, 6:13:26 AM
Views: 75
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.