Liketrek
Monthly
Server-side request forgery in TREK (versions prior to 3.4.0) allows an authenticated user to reach internal services or cloud metadata by supplying a URL whose DNS AAAA answer is a NAT64, 6to4, or Teredo IPv6 transition address that encodes a private, loopback, or link-local IPv4 target, bypassing the checkSsrf guard in server/src/utils/ssrfGuard.ts. Exploitation is conditional rather than automatic: it requires a valid TREK account, attacker control of a DNS record, a feature that performs server-side egress (imports, webhooks, integrations, or plugin egress), and a hosting environment that actually routes the chosen transition format - the reason the assessed CVSS is 6.3 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) with high attack complexity and confidentiality-only impact. No public exploit code has been identified at time of analysis, and TREK 3.4.0 fixes the flaw.
Incorrect authorization in liketrek TREK's Journey Photo Proxy (all versions through 3.0.22) enables remote unauthenticated attackers to bypass share token validation in the `validateShareTokenForAsset` function, potentially exposing journey photos without a valid share token. The CVSS 4.0 score of 6.3 reflects high attack complexity that constrains practical exploitation despite requiring no authentication or user interaction. No public exploit code exists and this vulnerability is absent from the CISA KEV catalog; vendor-released patch v3.1.0 is available and strongly recommended for all self-hosted instances.
Path traversal in the liketrek TREK Public Journey Photo Proxy controller allows remote attackers - without authentication - to read files outside the intended directory on self-hosted instances running version 3.0.22 or earlier. The affected endpoint (`server/src/nest/journey/journey-public.controller.ts`) fails to adequately sanitize path inputs, exposing server-side files to limited confidentiality disclosure. No public exploit has been identified and the CVE is not listed in the CISA KEV catalog; a vendor-released patch is available in v3.1.0.
Improper authentication in liketrek TREK up to version 3.0.22 allows a remote unauthenticated attacker to bypass the OIDC login flow by exploiting flawed user-lookup logic in the `findOrCreateUser` function of `server/src/services/oidcService.ts`. Successful exploitation - rated high attack complexity - could allow an attacker to authenticate as an arbitrary user without valid credentials. No public exploit or CISA KEV listing exists; however, the vendor's v3.1.0 release notes describe this as a 'critical authentication bypass' among 18 privately-reported vulnerabilities, and updating is strongly recommended for all self-hosted instances.
SQL injection in liketrek TREK's Journey Entry Update endpoint allows authenticated remote attackers to manipulate underlying database queries via the journeyService.updateEntry function in versions up to and including 3.0.22. The flaw (CWE-89) is network-reachable but requires a valid user session (PR:L), constraining the attack surface to authenticated users of self-hosted instances. No public exploit code or CISA KEV listing exists at time of analysis; the issue was privately disclosed alongside 17 other vulnerabilities all remediated in the 3.1.0 release.
Authentication bypass in liketrek TREK up to v3.0.22 allows a remote attacker with valid credentials to circumvent two-factor authentication by manipulating the mfa_token parameter in the Pre-2FA handler of the loginUser function (authService.ts). The CVSS 4.0 vector (PR:L) confirms low-privilege credentials are a prerequisite, meaning the bypass targets users who have valid username/password combinations but should still be blocked by a second factor. The vendor's own release notes for v3.1.0 describe this as a 'critical authentication bypass' - one of 18 privately reported security issues - and strongly recommend immediate upgrade for all self-hosted instances. No public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in TREK (versions prior to 3.4.0) allows an authenticated user to reach internal services or cloud metadata by supplying a URL whose DNS AAAA answer is a NAT64, 6to4, or Teredo IPv6 transition address that encodes a private, loopback, or link-local IPv4 target, bypassing the checkSsrf guard in server/src/utils/ssrfGuard.ts. Exploitation is conditional rather than automatic: it requires a valid TREK account, attacker control of a DNS record, a feature that performs server-side egress (imports, webhooks, integrations, or plugin egress), and a hosting environment that actually routes the chosen transition format - the reason the assessed CVSS is 6.3 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) with high attack complexity and confidentiality-only impact. No public exploit code has been identified at time of analysis, and TREK 3.4.0 fixes the flaw.
Incorrect authorization in liketrek TREK's Journey Photo Proxy (all versions through 3.0.22) enables remote unauthenticated attackers to bypass share token validation in the `validateShareTokenForAsset` function, potentially exposing journey photos without a valid share token. The CVSS 4.0 score of 6.3 reflects high attack complexity that constrains practical exploitation despite requiring no authentication or user interaction. No public exploit code exists and this vulnerability is absent from the CISA KEV catalog; vendor-released patch v3.1.0 is available and strongly recommended for all self-hosted instances.
Path traversal in the liketrek TREK Public Journey Photo Proxy controller allows remote attackers - without authentication - to read files outside the intended directory on self-hosted instances running version 3.0.22 or earlier. The affected endpoint (`server/src/nest/journey/journey-public.controller.ts`) fails to adequately sanitize path inputs, exposing server-side files to limited confidentiality disclosure. No public exploit has been identified and the CVE is not listed in the CISA KEV catalog; a vendor-released patch is available in v3.1.0.
Improper authentication in liketrek TREK up to version 3.0.22 allows a remote unauthenticated attacker to bypass the OIDC login flow by exploiting flawed user-lookup logic in the `findOrCreateUser` function of `server/src/services/oidcService.ts`. Successful exploitation - rated high attack complexity - could allow an attacker to authenticate as an arbitrary user without valid credentials. No public exploit or CISA KEV listing exists; however, the vendor's v3.1.0 release notes describe this as a 'critical authentication bypass' among 18 privately-reported vulnerabilities, and updating is strongly recommended for all self-hosted instances.
SQL injection in liketrek TREK's Journey Entry Update endpoint allows authenticated remote attackers to manipulate underlying database queries via the journeyService.updateEntry function in versions up to and including 3.0.22. The flaw (CWE-89) is network-reachable but requires a valid user session (PR:L), constraining the attack surface to authenticated users of self-hosted instances. No public exploit code or CISA KEV listing exists at time of analysis; the issue was privately disclosed alongside 17 other vulnerabilities all remediated in the 3.1.0 release.
Authentication bypass in liketrek TREK up to v3.0.22 allows a remote attacker with valid credentials to circumvent two-factor authentication by manipulating the mfa_token parameter in the Pre-2FA handler of the loginUser function (authService.ts). The CVSS 4.0 vector (PR:L) confirms low-privilege credentials are a prerequisite, meaning the bypass targets users who have valid username/password combinations but should still be blocked by a second factor. The vendor's own release notes for v3.1.0 describe this as a 'critical authentication bypass' - one of 18 privately reported security issues - and strongly recommend immediate upgrade for all self-hosted instances. No public exploit code or CISA KEV listing has been identified at time of analysis.