EUVD-2026-63642Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Requires authenticated file-edit access (PR:L); only reservation titles disclosed across trip boundary (C:L); no integrity or availability impact; scope unchanged.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservation_id, place_id, and assignment_id values without using findForeignLinkTarget() to verify that the referenced object belongs to the file's trip. An authenticated user with file-edit permission on any accessible trip can submit a foreign reservation identifier through POST /api/trips/:tripId/files/:id/link, POST /api/trips/:tripId/files, or PUT /api/trips/:tripId/files/:id. Subsequent reads through FILE_SELECT or getFileLinks() join the foreign reservation and return reservation_title, disclosing reservation existence and titles across private trip boundaries. This issue is fixed in version 3.1.3.
AnalysisAI
Insecure direct object reference in TREK collaborative travel planner before 3.1.3 allows any authenticated user with file-edit permission on any accessible trip to disclose reservation titles from private trips they do not own. By supplying attacker-controlled reservation_id, place_id, or assignment_id values to three file management API endpoints, the server joins the foreign reservation record in subsequent FILE_SELECT or getFileLinks() database queries and returns reservation_title in the response, crossing private trip boundaries. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid TREK user account with file-edit permission on at least one trip accessible to the attacker - no admin or owner role is needed, only the file-edit grant on any trip (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 base score (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately represents the limited blast radius: the attack is network-accessible with no special configuration and low complexity, but requires a valid authenticated session with file-edit rights on at least one trip (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated TREK user who has been granted file-edit access to their own trip enumerates or guesses a valid reservation_id belonging to a different user's private trip, then submits a POST /api/trips/:tripId/files/:id/link request embedding that foreign identifier. When the server subsequently executes getFileLinks() or FILE_SELECT for any file on the attacker's trip, the ORM join returns the private trip's reservation_title in the JSON response, revealing itinerary details without any elevated privileges or special tooling beyond a standard HTTP client. |
| Remediation | Upgrade TREK to version 3.1.3 or later; the fix was delivered via commit 03cdb4d27689922460ba87085d04b426d4d40d26 (PR #1324) and applies findForeignLinkTarget() validation to reservation_id, place_id, and assignment_id inputs across all three affected file endpoints. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in TREK collaborative travel planner (versions prior to 2.7.2) allows authenticated attackers with
Share-link token theft in TREK versions 3.0.0 through 3.0.x allows any ordinary authenticated user to exfiltrate private
Path traversal in the liketrek TREK Public Journey Photo Proxy controller allows remote attackers - without authenticati
Improper authentication in liketrek TREK up to version 3.0.22 allows a remote unauthenticated attacker to bypass the OID
Incorrect authorization in liketrek TREK's Journey Photo Proxy (all versions through 3.0.22) enables remote unauthentica
Server-Side Request Forgery in TREK, a collaborative travel planner, allows any authenticated user to pivot the server i
Authentication bypass in liketrek TREK up to v3.0.22 allows a remote attacker with valid credentials to circumvent two-f
SQL injection in liketrek TREK's Journey Entry Update endpoint allows authenticated remote attackers to manipulate under
TREK collaborative travel planner versions before 2.7.2 serve uploaded user photos without authentication, allowing unau
Stored HTML injection in TREK collaborative travel planner (versions prior to 3.1.0) enables content spoofing and UI red
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today