CVE-2026-23838

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23838", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-16T15:46:40.842Z", "datePublished": "2026-01-19T18:14:55.567Z", "dateUpdated": "2026-01-20T21:41:34.412Z"}, "containers": {"cna": {"title": "Tandoor Recipes module allows SQLite database to be externally accessible with the default settings", "problemTypes": [{"descriptions": [{"cweId": "CWE-538", "lang": "en", "description": "CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/NixOS/nixpkgs/security/advisories/GHSA-g8w3-p77x-mmxh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/NixOS/nixpkgs/security/advisories/GHSA-g8w3-p77x-mmxh"}, {"name": "https://github.com/NixOS/nixpkgs/issues/338339", "tags": ["x_refsource_MISC"], "url": "https://github.com/NixOS/nixpkgs/issues/338339"}, {"name": "https://github.com/NixOS/nixpkgs/pull/427845", "tags": ["x_refsource_MISC"], "url": "https://github.com/NixOS/nixpkgs/pull/427845"}, {"name": "https://github.com/NixOS/nixpkgs/pull/481140", "tags": ["x_refsource_MISC"], "url": "https://github.com/NixOS/nixpkgs/pull/481140"}], "affected": [{"vendor": "NixOS", "product": "nixpkgs", "versions": [{"version": ">= 23.05, < 26.05", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-19T18:14:55.567Z"}, "descriptions": [{"lang": "en", "value": "Tandoor Recipes is a recipe manager than can be installed with the Nix package manager. Starting in version 23.05 and prior to version 26.05, when using the default configuration of Tandoor Recipes, specifically using SQLite and default `MEDIA_ROOT`, the full database file may be externally accessible, potentially on the Internet. The root cause is that the NixOS module configures the working directory of Tandoor Recipes, as well as the value of `MEDIA_ROOT`, to be `/var/lib/tandoor-recipes`. This causes Tandoor Recipes to create its `db.sqlite3` database file in the same directory as `MEDIA_ROOT` causing it to be accessible without authentication through HTTP like any other media file. This is the case when using `GUNICORN_MEDIA=1` or when using a web server like nginx to serve media files. NixOS 26.05 changes the default value of `MEDIA_ROOT` to a sub folder of the data directory. This only applies to configurations with `system.stateVersion` >= 26.05. For older configurations, one of the workarounds should be applied instead. NixOS 25.11 has received a backport of this patch, though it doesn't fix this vulnerability without user intervention. A recommended workaround is to move `MEDIA_ROOT` into a subdirectory. Non-recommended workarounds include switching to PostgreSQL or disallowing access to `db.sqlite3`."}], "source": {"advisory": "GHSA-g8w3-p77x-mmxh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T21:41:20.975315Z", "id": "CVE-2026-23838", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T21:41:34.412Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23838", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T21:41:20.975315Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T21:41:31.707Z"}}], "cna": {"title": "Tandoor Recipes module allows SQLite database to be externally accessible with the default settings", "source": {"advisory": "GHSA-g8w3-p77x-mmxh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "NixOS", "product": "nixpkgs", "versions": [{"status": "affected", "version": ">= 23.05, < 26.05"}]}], "references": [{"url": "https://github.com/NixOS/nixpkgs/security/advisories/GHSA-g8w3-p77x-mmxh", "name": "https://github.com/NixOS/nixpkgs/security/advisories/GHSA-g8w3-p77x-mmxh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/NixOS/nixpkgs/issues/338339", "name": "https://github.com/NixOS/nixpkgs/issues/338339", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/NixOS/nixpkgs/pull/427845", "name": "https://github.com/NixOS/nixpkgs/pull/427845", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/NixOS/nixpkgs/pull/481140", "name": "https://github.com/NixOS/nixpkgs/pull/481140", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Tandoor Recipes is a recipe manager than can be installed with the Nix package manager. Starting in version 23.05 and prior to version 26.05, when using the default configuration of Tandoor Recipes, specifically using SQLite and default `MEDIA_ROOT`, the full database file may be externally accessible, potentially on the Internet. The root cause is that the NixOS module configures the working directory of Tandoor Recipes, as well as the value of `MEDIA_ROOT`, to be `/var/lib/tandoor-recipes`. This causes Tandoor Recipes to create its `db.sqlite3` database file in the same directory as `MEDIA_ROOT` causing it to be accessible without authentication through HTTP like any other media file. This is the case when using `GUNICORN_MEDIA=1` or when using a web server like nginx to serve media files. NixOS 26.05 changes the default value of `MEDIA_ROOT` to a sub folder of the data directory. This only applies to configurations with `system.stateVersion` >= 26.05. For older configurations, one of the workarounds should be applied instead. NixOS 25.11 has received a backport of this patch, though it doesn't fix this vulnerability without user intervention. A recommended workaround is to move `MEDIA_ROOT` into a subdirectory. Non-recommended workarounds include switching to PostgreSQL or disallowing access to `db.sqlite3`."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-538", "description": "CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-19T18:14:55.567Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23838", "state": "PUBLISHED", "dateUpdated": "2026-01-20T21:41:34.412Z", "dateReserved": "2026-01-16T15:46:40.842Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-19T18:14:55.567Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nixpkgs", "vendor": "NixOS", "versions": [{"status": "affected", "version": ">= 23.05, < 26.05"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tandoor Recipes is a recipe manager than can be installed with the Nix package manager. Starting in version 23.05 and prior to version 26.05, when using the default configuration of Tandoor Recipes, specifically using SQLite and default `MEDIA_ROOT`, the full database file may be externally accessible, potentially on the Internet. The root cause is that the NixOS module configures the working directory of Tandoor Recipes, as well as the value of `MEDIA_ROOT`, to be `/var/lib/tandoor-recipes`. This causes Tandoor Recipes to create its `db.sqlite3` database file in the same directory as `MEDIA_ROOT` causing it to be accessible without authentication through HTTP like any other media file. This is the case when using `GUNICORN_MEDIA=1` or when using a web server like nginx to serve media files. NixOS 26.05 changes the default value of `MEDIA_ROOT` to a sub folder of the data directory. This only applies to configurations with `system.stateVersion` >= 26.05. For older configurations, one of the workarounds should be applied instead. NixOS 25.11 has received a backport of this patch, though it doesn't fix this vulnerability without user intervention. A recommended workaround is to move `MEDIA_ROOT` into a subdirectory. Non-recommended workarounds include switching to PostgreSQL or disallowing access to `db.sqlite3`."}, {"lang": "es", "value": "Tandoor Recipes es un gestor de recetas que se puede instalar con el gestor de paquetes Nix. A partir de la versi\u00f3n 23.05 y antes de la versi\u00f3n 26.05, al usar la configuraci\u00f3n predeterminada de Tandoor Recipes, espec\u00edficamente usando SQLite y el `MEDIA_ROOT` predeterminado, el archivo completo de la base de datos puede ser accesible externamente, potencialmente en Internet. La causa ra\u00edz es que el m\u00f3dulo de NixOS configura el directorio de trabajo de Tandoor Recipes, as\u00ed como el valor de `MEDIA_ROOT`, para que sea `/var/lib/tandoor-recipes`. Esto hace que Tandoor Recipes cree su archivo de base de datos `db.sqlite3` en el mismo directorio que `MEDIA_ROOT` haci\u00e9ndolo accesible sin autenticaci\u00f3n a trav\u00e9s de HTTP como cualquier otro archivo multimedia. Este es el caso al usar `GUNICORN_MEDIA=1` o al usar un servidor web como nginx para servir archivos multimedia. NixOS 26.05 cambia el valor predeterminado de `MEDIA_ROOT` a una subcarpeta del directorio de datos. Esto solo se aplica a configuraciones con `system.stateVersion` &gt;= 26.05. Para configuraciones m\u00e1s antiguas, una de las soluciones alternativas deber\u00eda aplicarse en su lugar. NixOS 25.11 ha recibido un backport de este parche, aunque no corrige esta vulnerabilidad sin intervenci\u00f3n del usuario. Una soluci\u00f3n alternativa recomendada es mover `MEDIA_ROOT` a un subdirectorio. Las soluciones alternativas no recomendadas incluyen cambiar a PostgreSQL o denegar el acceso a `db.sqlite3`."}], "id": "CVE-2026-23838", "lastModified": "2026-06-17T10:22:10.910", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23838", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T21:41:20.975315Z", "version": "2.0.3"}}]}, "published": "2026-01-19T19:16:03.937", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/NixOS/nixpkgs/issues/338339"}, {"source": "security-advisories@github.com", "url": "https://github.com/NixOS/nixpkgs/pull/427845"}, {"source": "security-advisories@github.com", "url": "https://github.com/NixOS/nixpkgs/pull/481140"}, {"source": "security-advisories@github.com", "url": "https://github.com/NixOS/nixpkgs/security/advisories/GHSA-g8w3-p77x-mmxh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-538"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T15:51:22.355774+00:00", "value": {"mitigation_remediation": ["Move or configure the MEDIA_ROOT directory to a subdirectory so that the db.sqlite3 file is not served by the web server.", "Configure the web server (e.g., nginx or GUNICORN_MEDIA) to block HTTP access to the directory containing db.sqlite3.", "Upgrade to NixOS 26.05 or apply the 25.11 backport patch and then adjust MEDIA_ROOT to the new default subfolder."], "summary": {"action": "Apply Workaround", "impact": "Unauthorized access to the Tandoor Recipes SQLite database via HTTP without authentication"}, "threat_synthesis": {"affected_systems": "The flaw affects the NixOS package collection, specifically the Tandoor Recipes module available from the nixpkgs repository. Versions beginning with 23.05 through 26.04 are vulnerable when using the default configuration. NixOS 26.05 changes the default MEDIA_ROOT to a subdirectory of the data directory, eliminating the issue for configurations whose system.stateVersion is 26.05 or newer. Earlier configurations can mitigate the problem with the recommended workarounds, and a NixOS 25.11 backport exists but requires user action.", "description_and_impact": "The vulnerability resides in the default configuration of the Tandoor Recipes package managed by NixOS. When SQLite is used with the default MEDIA_ROOT directory, the application places its database file, db.sqlite3, alongside media assets. Because the web server serves media files from this directory, the database file becomes reachable through ordinary HTTP requests, exposing all stored data with no authentication. This is a confidentiality breach described by CWE-538.", "risk_and_exploitability": "The CVSS base score of 8.7 indicates a high impact, while the EPSS score of less than 1% suggests a low probability of exploitation as of the latest data. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote HTTP request to the media directory, retrieving the db.sqlite3 file if the server is configured to serve media files from that location. Once accessed, the database contents could be read by any network adversary with reach to the host."}}}}, "created": "2026-01-20T08:40:46.868411+00:00", "updated": "2026-04-18T16:00:04.283810+00:00", "vendors": ["nixos", "nixos$PRODUCT$nixos", "tandoor", "tandoor$PRODUCT$recipes"]}