EUVD-2026-65474
GHSA-pw55-389h-h6rh
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable public endpoint with no authentication (AV:N, PR:N) but high exploitation complexity (AC:H); only limited file read is achievable (C:L) with no integrity or availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/src/nest/journey/journey-public.controller.ts of the component Public Journey Photo Proxy. Performing a manipulation results in path traversal. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. Upgrading to version 3.1.0 mitigates this issue. It is advisable to upgrade the affected component.
AnalysisAI
Path traversal in the liketrek TREK Public Journey Photo Proxy controller allows remote attackers - without authentication - to read files outside the intended directory on self-hosted instances running version 3.0.22 or earlier. The affected endpoint (server/src/nest/journey/journey-public.controller.ts) fails to adequately sanitize path inputs, exposing server-side files to limited confidentiality disclosure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must be running liketrek TREK version 3.0.22 or earlier with the instance network-accessible to the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.3 with AV:N/AC:H/PR:N/UI:N reflects a remotely reachable, unauthenticated attack surface paired with high exploitation complexity - meaning this is not a trivially weaponizable flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated remote attacker sends a crafted HTTP GET request to the TREK Public Journey Photo Proxy endpoint, embedding path traversal sequences (e.g., `../../.env` or URL-encoded equivalents) in the filename or path parameter. If the server's partial validation is bypassed through encoding tricks or specific path structures, the server returns the contents of files outside the media directory - potentially including the application's `.env` file containing database credentials or API keys. … |
| Remediation | The primary remediation is to upgrade liketrek TREK to version 3.1.0, the vendor-released patch available at https://github.com/liketrek/TREK/releases/tag/v3.1.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in TREK collaborative travel planner (versions prior to 2.7.2) allows authenticated attackers with
Share-link token theft in TREK versions 3.0.0 through 3.0.x allows any ordinary authenticated user to exfiltrate private
Improper authentication in liketrek TREK up to version 3.0.22 allows a remote unauthenticated attacker to bypass the OID
Incorrect authorization in liketrek TREK's Journey Photo Proxy (all versions through 3.0.22) enables remote unauthentica
Server-Side Request Forgery in TREK, a collaborative travel planner, allows any authenticated user to pivot the server i
Authentication bypass in liketrek TREK up to v3.0.22 allows a remote attacker with valid credentials to circumvent two-f
SQL injection in liketrek TREK's Journey Entry Update endpoint allows authenticated remote attackers to manipulate under
Insecure direct object reference in TREK collaborative travel planner before 3.1.3 allows any authenticated user with fi
TREK collaborative travel planner versions before 2.7.2 serve uploaded user photos without authentication, allowing unau
Stored HTML injection in TREK collaborative travel planner (versions prior to 3.1.0) enables content spoofing and UI red
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today