Executive Summary

CVE-2026-29055 is a vulnerability in the Tandoor Recipes application (versions prior to 2.6.0) related to how it processes image uploads, specifically WebP and GIF formats.

The application skips important processing steps such as stripping EXIF metadata, image rescaling, and size validation for these image types. As a result, sensitive EXIF metadata embedded in uploaded WebP images—like GPS coordinates, camera model, timestamps, and software information—is stored and served to all users who can view the recipe images.

This happens because the image processing function returns the raw uploaded image for WebP and GIF formats without any modification, unlike JPEG and PNG images which are properly processed.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a privacy breach by exposing sensitive EXIF metadata to any user who can view the uploaded recipe images.

• Leakage of GPS coordinates, potentially revealing exact photo locations such as home or workplace.
• Device fingerprinting through camera make and model information.
• Reconstruction of user activity timelines using timestamps embedded in the images.
• Operating system fingerprinting from software version tags.
• Potential thumbnail leakage even if users crop images.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability may cause violations of privacy regulations such as GDPR and CCPA due to the unauthorized retention and exposure of personal data embedded in EXIF metadata.

Since sensitive personal information like location data and device identifiers is exposed without user consent or proper safeguards, affected organizations could face compliance issues under these regulations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by inspecting uploaded WebP or GIF images in the Tandoor Recipes application to check if they contain EXIF metadata such as GPS coordinates, camera model, timestamps, or software information.

One approach is to download images uploaded to the system and analyze their metadata using image processing tools or libraries that can read EXIF data.

For example, you can use the command-line tool 'exiftool' to inspect images for embedded metadata:

• exiftool image.webp
• exiftool image.gif

If these commands reveal GPS coordinates, camera details, or timestamps, it indicates the vulnerability is present and EXIF data is not being stripped.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the Tandoor Recipes application to version 2.6.0 or later, where the vulnerability has been fixed by implementing proper EXIF metadata stripping and image validation for WebP and GIF formats.

Until the upgrade is applied, avoid accepting WebP and GIF image uploads or manually strip EXIF metadata from these images before uploading them.

You can use tools like 'exiftool' to remove metadata from images before upload:

• exiftool -all= image.webp
• exiftool -all= image.gif

Additionally, review and restrict image upload formats or implement server-side image processing to ensure metadata is stripped.

Useful 0 Not Useful 0