CVE-2026-23838

{"id": "CVE-2026-23838", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-01-19T19:16:03.937", "references": [{"url": "https://github.com/NixOS/nixpkgs/issues/338339", "source": "security-advisories@github.com"}, {"url": "https://github.com/NixOS/nixpkgs/pull/427845", "source": "security-advisories@github.com"}, {"url": "https://github.com/NixOS/nixpkgs/pull/481140", "source": "security-advisories@github.com"}, {"url": "https://github.com/NixOS/nixpkgs/security/advisories/GHSA-g8w3-p77x-mmxh", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-538"}]}], "descriptions": [{"lang": "en", "value": "Tandoor Recipes is a recipe manager than can be installed with the Nix package manager. Starting in version 23.05 and prior to version 26.05, when using the default configuration of Tandoor Recipes, specifically using SQLite and default `MEDIA_ROOT`, the full database file may be externally accessible, potentially on the Internet. The root cause is that the NixOS module configures the working directory of Tandoor Recipes, as well as the value of `MEDIA_ROOT`, to be `/var/lib/tandoor-recipes`. This causes Tandoor Recipes to create its `db.sqlite3` database file in the same directory as `MEDIA_ROOT` causing it to be accessible without authentication through HTTP like any other media file. This is the case when using `GUNICORN_MEDIA=1` or when using a web server like nginx to serve media files. NixOS 26.05 changes the default value of `MEDIA_ROOT` to a sub folder of the data directory. This only applies to configurations with `system.stateVersion` >= 26.05. For older configurations, one of the workarounds should be applied instead. NixOS 25.11 has received a backport of this patch, though it doesn't fix this vulnerability without user intervention. A recommended workaround is to move `MEDIA_ROOT` into a subdirectory. Non-recommended workarounds include switching to PostgreSQL or disallowing access to `db.sqlite3`."}, {"lang": "es", "value": "Tandoor Recipes es un gestor de recetas que se puede instalar con el gestor de paquetes Nix. A partir de la versi\u00f3n 23.05 y antes de la versi\u00f3n 26.05, al usar la configuraci\u00f3n predeterminada de Tandoor Recipes, espec\u00edficamente usando SQLite y el `MEDIA_ROOT` predeterminado, el archivo completo de la base de datos puede ser accesible externamente, potencialmente en Internet. La causa ra\u00edz es que el m\u00f3dulo de NixOS configura el directorio de trabajo de Tandoor Recipes, as\u00ed como el valor de `MEDIA_ROOT`, para que sea `/var/lib/tandoor-recipes`. Esto hace que Tandoor Recipes cree su archivo de base de datos `db.sqlite3` en el mismo directorio que `MEDIA_ROOT` haci\u00e9ndolo accesible sin autenticaci\u00f3n a trav\u00e9s de HTTP como cualquier otro archivo multimedia. Este es el caso al usar `GUNICORN_MEDIA=1` o al usar un servidor web como nginx para servir archivos multimedia. NixOS 26.05 cambia el valor predeterminado de `MEDIA_ROOT` a una subcarpeta del directorio de datos. Esto solo se aplica a configuraciones con `system.stateVersion` >= 26.05. Para configuraciones m\u00e1s antiguas, una de las soluciones alternativas deber\u00eda aplicarse en su lugar. NixOS 25.11 ha recibido un backport de este parche, aunque no corrige esta vulnerabilidad sin intervenci\u00f3n del usuario. Una soluci\u00f3n alternativa recomendada es mover `MEDIA_ROOT` a un subdirectorio. Las soluciones alternativas no recomendadas incluyen cambiar a PostgreSQL o denegar el acceso a `db.sqlite3`."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "security-advisories@github.com"}