Skip to main content

TREK CVE-2026-54508

| EUVDEUVD-2026-63704 MEDIUM
Server-Side Request Forgery (SSRF) (CWE-918)
2026-08-20 GitHub_M
SSRF Trek
5.3
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.4 MEDIUM

Network vector with low privileges (any authenticated user); blind SSRF yields limited confidentiality/integrity impact and no measurable availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 20, 2026 - 23:13 vuln.today
Analysis Generated
Aug 20, 2026 - 23:13 vuln.today
Patch available
Aug 20, 2026 - 22:04 EUVD

DescriptionCVE.org

TREK is a collaborative travel planner. Prior to 3.1.0, TREK validates only the initial URL before native redirect following in importGoogleList() and importNaverList() in server/src/services/placeService.ts and resolveGoogleMapsUrl() in server/src/services/mapsService.ts. The affected sinks call checkSsrf() from server/src/utils/ssrfGuard.ts and then use fetch() with redirect: 'follow' instead of the DNS-pinned safeFetch() path, so a public attacker-controlled URL can redirect the server to loopback, RFC 1918, or cloud metadata addresses without revalidation. An authenticated trip member can reach the list-import routes, and any authenticated user can reach /api/maps/resolve-url, allowing blind GET requests to internal services without response-body reflection. This issue is fixed in version 3.1.0.

AnalysisAI

Server-Side Request Forgery in TREK, a collaborative travel planner, allows any authenticated user to pivot the server into making blind GET requests against loopback addresses, RFC 1918 internal networks, or cloud instance metadata endpoints (e.g., 169.254.169.254). The root cause is that importGoogleList(), importNaverList(), and resolveGoogleMapsUrl() validate only the initial submitted URL via checkSsrf() but then call native fetch() with redirect:'follow', bypassing DNS-pinned safeFetch() on redirect hops. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate to TREK instance
Delivery
Submit crafted URL to /api/maps/resolve-url or list-import route
Exploit
Server validates initial URL via checkSsrf()
Execution
Attacker-controlled host returns HTTP redirect to internal address
Persist
Server follows redirect via unguarded fetch()
Impact
Blind GET request hits loopback or cloud metadata endpoint
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid TREK user account. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) correctly identifies network reachability with no special attack requirements beyond holding a valid user session. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated TREK user submits a crafted Google Maps or Naver Maps list URL pointing to an attacker-controlled HTTP server. That server responds with a 301 redirect to http://169.254.169.254/latest/meta-data/ (AWS instance metadata) or http://10.0.0.1/ (internal network). …
Remediation Upgrade TREK to version 3.1.0, which resolves the vulnerability per the vendor-released patch confirmed in commit ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11 (https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11) and pull request #1185 (https://github.com/liketrek/TREK/pull/1185). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Trek

View all
CVE-2026-40185 HIGH
7.1 Apr 10

Authentication bypass in TREK collaborative travel planner (versions prior to 2.7.2) allows authenticated attackers with
CVE-2026-54509 MEDIUM
6.5 Aug 20

Share-link token theft in TREK versions 3.0.0 through 3.0.x allows any ordinary authenticated user to exfiltrate private
CVE-2026-78886 MEDIUM
6.3 Aug 25

Path traversal in the liketrek TREK Public Journey Photo Proxy controller allows remote attackers - without authenticati
CVE-2026-78885 MEDIUM
6.3 Aug 25

Improper authentication in liketrek TREK up to version 3.0.22 allows a remote unauthenticated attacker to bypass the OID
CVE-2026-78887 MEDIUM
6.3 Aug 25

Incorrect authorization in liketrek TREK's Journey Photo Proxy (all versions through 3.0.22) enables remote unauthentica
CVE-2026-78863 MEDIUM
5.3 Aug 25

Authentication bypass in liketrek TREK up to v3.0.22 allows a remote attacker with valid credentials to circumvent two-f
CVE-2026-78864 MEDIUM
5.3 Aug 25

SQL injection in liketrek TREK's Journey Entry Update endpoint allows authenticated remote attackers to manipulate under
CVE-2026-62945 MEDIUM
4.3 Aug 20

Insecure direct object reference in TREK collaborative travel planner before 3.1.3 allows any authenticated user with fi
CVE-2026-40184 LOW
3.7 Apr 10

TREK collaborative travel planner versions before 2.7.2 serve uploaded user photos without authentication, allowing unau
CVE-2026-54505 LOW
2.0 Aug 20

Stored HTML injection in TREK collaborative travel planner (versions prior to 3.1.0) enables content spoofing and UI red

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2023-48022 CRITICAL POC
9.8

Same technique SSRF

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2016-3718 MEDIUM POC
5.5
CVE-2026-15409 CRITICAL POC
10.0

Share

CVE-2026-54508 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy