NixOS nixpkgs up to 26.4 /var/lib/tandoor-recipes file information disclosure

Summaryinfo

A vulnerability, which was classified as problematic, was found in NixOS nixpkgs up to 26.4. This impacts an unknown function in the library /var/lib/tandoor-recipes of the component NixOS Module. Executing a manipulation can lead to file information disclosure. This vulnerability is tracked as CVE-2026-23838. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in NixOS nixpkgs up to 26.4. This vulnerability affects some unknown functionality in the library /var/lib/tandoor-recipes of the component NixOS Module. The manipulation with an unknown input leads to a file information disclosure vulnerability. The CWE definition for the vulnerability is CWE-538. The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information. As an impact it is known to affect confidentiality. CVE summarizes:

Tandoor Recipes is a recipe manager than can be installed with the Nix package manager. Starting in version 23.05 and prior to version 26.05, when using the default configuration of Tandoor Recipes, specifically using SQLite and default `MEDIA_ROOT`, the full database file may be externally accessible, potentially on the Internet. The root cause is that the NixOS module configures the working directory of Tandoor Recipes, as well as the value of `MEDIA_ROOT`, to be `/var/lib/tandoor-recipes`. This causes Tandoor Recipes to create its `db.sqlite3` database file in the same directory as `MEDIA_ROOT` causing it to be accessible without authentication through HTTP like any other media file. This is the case when using `GUNICORN_MEDIA=1` or when using a web server like nginx to serve media files. NixOS 26.05 changes the default value of `MEDIA_ROOT` to a sub folder of the data directory. This only applies to configurations with `system.stateVersion` >= 26.05. For older configurations, one of the workarounds should be applied instead. NixOS 25.11 has received a backport of this patch, though it doesn't fix this vulnerability without user intervention. A recommended workaround is to move `MEDIA_ROOT` into a subdirectory. Non-recommended workarounds include switching to PostgreSQL or disallowing access to `db.sqlite3`.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-23838 since 01/16/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1083.

Upgrading to version 26.05 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-3303). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• NixOS

Name

• nixpkgs

Version

• 26.0
• 26.1
• 26.2
• 26.3
• 26.4

Website

• Product: https://github.com/NixOS/nixpkgs/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion