{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-19T06:48:41.203","vulnerabilities":[{"cve":{"id":"CVE-2026-23838","sourceIdentifier":"security-advisories@github.com","published":"2026-01-19T19:16:03.937","lastModified":"2026-04-15T00:35:42.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Tandoor Recipes is a recipe manager than can be installed with the Nix package manager. Starting in version 23.05 and prior to version 26.05, when using the default configuration of Tandoor Recipes, specifically using SQLite and default `MEDIA_ROOT`, the full database file may be externally accessible, potentially on the Internet. The root cause is that the NixOS module configures the working directory of Tandoor Recipes, as well as the value of `MEDIA_ROOT`, to be `/var/lib/tandoor-recipes`. This causes Tandoor Recipes to create its `db.sqlite3` database file in the same directory as `MEDIA_ROOT` causing it to be accessible without authentication through HTTP like any other media file. This is the case when using `GUNICORN_MEDIA=1` or when using a web server like nginx to serve media files. NixOS 26.05 changes the default value of `MEDIA_ROOT` to a sub folder of the data directory. This only applies to configurations with `system.stateVersion` >= 26.05. For older configurations, one of the workarounds should be applied instead. NixOS 25.11 has received a backport of this patch, though it doesn't fix this vulnerability without user intervention. A recommended workaround is to move `MEDIA_ROOT` into a subdirectory. Non-recommended workarounds include switching to PostgreSQL or disallowing access to `db.sqlite3`."},{"lang":"es","value":"Tandoor Recipes es un gestor de recetas que se puede instalar con el gestor de paquetes Nix. A partir de la versión 23.05 y antes de la versión 26.05, al usar la configuración predeterminada de Tandoor Recipes, específicamente usando SQLite y el `MEDIA_ROOT` predeterminado, el archivo completo de la base de datos puede ser accesible externamente, potencialmente en Internet. La causa raíz es que el módulo de NixOS configura el directorio de trabajo de Tandoor Recipes, así como el valor de `MEDIA_ROOT`, para que sea `/var/lib/tandoor-recipes`. Esto hace que Tandoor Recipes cree su archivo de base de datos `db.sqlite3` en el mismo directorio que `MEDIA_ROOT` haciéndolo accesible sin autenticación a través de HTTP como cualquier otro archivo multimedia. Este es el caso al usar `GUNICORN_MEDIA=1` o al usar un servidor web como nginx para servir archivos multimedia. NixOS 26.05 cambia el valor predeterminado de `MEDIA_ROOT` a una subcarpeta del directorio de datos. Esto solo se aplica a configuraciones con `system.stateVersion` >= 26.05. Para configuraciones más antiguas, una de las soluciones alternativas debería aplicarse en su lugar. NixOS 25.11 ha recibido un backport de este parche, aunque no corrige esta vulnerabilidad sin intervención del usuario. Una solución alternativa recomendada es mover `MEDIA_ROOT` a un subdirectorio. Las soluciones alternativas no recomendadas incluyen cambiar a PostgreSQL o denegar el acceso a `db.sqlite3`."}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-538"}]}],"references":[{"url":"https://github.com/NixOS/nixpkgs/issues/338339","source":"security-advisories@github.com"},{"url":"https://github.com/NixOS/nixpkgs/pull/427845","source":"security-advisories@github.com"},{"url":"https://github.com/NixOS/nixpkgs/pull/481140","source":"security-advisories@github.com"},{"url":"https://github.com/NixOS/nixpkgs/security/advisories/GHSA-g8w3-p77x-mmxh","source":"security-advisories@github.com"}]}}]}