liketrek TREK CVE-2026-78886

The target must be running liketrek TREK version 3.0.22 or earlier with the instance network-accessible to the attacker. The Public Journey Photo Proxy endpoint is publicly accessible by design (no session authentication required), as it exists to serve photos for unauthenticated public journey views - this is the structural condition enabling unauthenticated exploitation. High attack complexity (AC:H) indicates that exploitation is not trivial: the attacker likely requires knowledge of the server's internal directory structure and may need to employ specific path encoding or traversal bypass techniques to circumvent partial input validation. There is no requirement for a registered account, special server configuration, or non-default feature flag; the vulnerable endpoint exists in all standard TREK 3.0.x deployments. File read is limited to files readable by the TREK server process user.

The CVSS 4.0 score of 6.3 with AV:N/AC:H/PR:N/UI:N reflects a remotely reachable, unauthenticated attack surface paired with high exploitation complexity - meaning this is not a trivially weaponizable flaw. The confidentiality impact is bounded to Low (VC:L) with no integrity or availability impact, consistent with a read-only path traversal with limited file scope. No EPSS score was included in the available intelligence, so exploitation probability cannot be quantified beyond inference from CVSS metrics. The CVE is absent from the CISA KEV catalog and no public proof-of-concept code has been identified, keeping the realistic threat level moderate. TREK is a niche self-hosted product with a small deployment footprint, which further constrains aggregate risk at the population level; however, any single self-hosted operator who is externally exposing their instance should treat this as a prompt patching priority since the .env file and other sensitive configuration artifacts could be reachable. The high attack complexity suggests the traversal may require specific path encoding or knowledge of the server's directory layout, which is a meaningful limiting factor absent from the raw CVSS base score alone.

An unauthenticated remote attacker sends a crafted HTTP GET request to the TREK Public Journey Photo Proxy endpoint, embedding path traversal sequences (e.g., ../../.env or URL-encoded equivalents) in the filename or path parameter. If the server's partial validation is bypassed through encoding tricks or specific path structures, the server returns the contents of files outside the media directory - potentially including the application's .env file containing database credentials or API keys. No public proof-of-concept exists at time of analysis, and the high attack complexity suggests some experimentation is required to identify the effective traversal payload.