Security Advisory: SQLite database externally accessible with the default settings of Tandoor Recipes module (CVE-2026-23838)

Announcements Security
1

Summary

When using the default configuration of Tandoor Recipes NixOs module, specifically using SQLite and default MEDIA_ROOT, the full database file may be externally accessible, potentially on the Internet.

Am I affected?

Every NixOS configurations using services.tandoor-recipes with the default settings and the SQLite backend are impacted.

What do I need to do?

Ensure your SQLite database is not publicly accessible, follow the remediation steps in the GitHub Security Advisory.

Starting with the following pull requests, evaluations of vulnerable configurations will trigger a warning:

Acknowledgement

Thank you to @Scrumplex for developing the fixes and writing the advisory.

7 Likes