TREK EUVD-2026-63704

Exploitation requires a valid TREK user account. The /api/maps/resolve-url endpoint is reachable by any authenticated user, making it the lower-barrier path. The list-import routes (importGoogleList, importNaverList) additionally require the authenticated user to be a member of a trip, narrowing that attack surface slightly. The attacker must control an external URL that serves an HTTP redirect (3xx) to the internal target - any internet-reachable server or compromised CDN endpoint suffices. Exploitation is further limited by the blind nature of the SSRF: no response body is reflected, so direct secret extraction requires out-of-band interaction (e.g., the internal service initiating an outbound callback). There is no requirement for a non-default configuration; the vulnerability is present in any standard TREK deployment running a version below 3.1.0.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) correctly identifies network reachability with no special attack requirements beyond holding a valid user session. The PR:L constraint is a meaningful limiter: an attacker must first authenticate before reaching either the list-import routes (which further require trip membership) or /api/maps/resolve-url (available to all authenticated users). The blind nature of the SSRF - no response body is returned - reduces the practical impact below that of a reflective SSRF; an attacker can probe for open internal ports and trigger unintended GET-based side effects but cannot directly read secrets or database contents. There is no CISA KEV entry and no publicly identified POC, which lowers urgency compared to an unauthenticated or reflective equivalent. Even a modestly sized deployment with low user counts should still prioritize patching, because the /api/maps/resolve-url endpoint is accessible to every authenticated user, widening the potential attacker pool. EPSS data was not provided; the combination of PR:L and blind impact suggests real-world exploitation is plausible but not imminent at scale. No conflicting signals between the CVSS vector and the description were found.

An authenticated TREK user submits a crafted Google Maps or Naver Maps list URL pointing to an attacker-controlled HTTP server. That server responds with a 301 redirect to http://169.254.169.254/latest/meta-data/ (AWS instance metadata) or http://10.0.0.1/ (internal network). TREK's server follows the redirect without re-invoking checkSsrf(), issuing a blind GET to the internal target; although the response is not returned to the attacker, the request can be logged by the internal service or used to infer which internal hosts are reachable. No public exploit code has been identified at time of analysis.