Trek
Monthly
Authentication bypass in TREK collaborative travel planner (versions prior to 2.7.2) allows authenticated attackers with low privileges to access and modify trip photos without proper authorization. The missing authorization checks on Immich trip photo management routes enable unauthorized data access (high confidentiality impact) and limited integrity compromise. Exploitation requires authenticated access but no user interaction, exploitable remotely over network with low attack complexity.
Incorrect authorization in liketrek TREK's Journey Photo Proxy (all versions through 3.0.22) enables remote unauthenticated attackers to bypass share token validation in the `validateShareTokenForAsset` function, potentially exposing journey photos without a valid share token. The CVSS 4.0 score of 6.3 reflects high attack complexity that constrains practical exploitation despite requiring no authentication or user interaction. No public exploit code exists and this vulnerability is absent from the CISA KEV catalog; vendor-released patch v3.1.0 is available and strongly recommended for all self-hosted instances.
Path traversal in the liketrek TREK Public Journey Photo Proxy controller allows remote attackers - without authentication - to read files outside the intended directory on self-hosted instances running version 3.0.22 or earlier. The affected endpoint (`server/src/nest/journey/journey-public.controller.ts`) fails to adequately sanitize path inputs, exposing server-side files to limited confidentiality disclosure. No public exploit has been identified and the CVE is not listed in the CISA KEV catalog; a vendor-released patch is available in v3.1.0.
Improper authentication in liketrek TREK up to version 3.0.22 allows a remote unauthenticated attacker to bypass the OIDC login flow by exploiting flawed user-lookup logic in the `findOrCreateUser` function of `server/src/services/oidcService.ts`. Successful exploitation - rated high attack complexity - could allow an attacker to authenticate as an arbitrary user without valid credentials. No public exploit or CISA KEV listing exists; however, the vendor's v3.1.0 release notes describe this as a 'critical authentication bypass' among 18 privately-reported vulnerabilities, and updating is strongly recommended for all self-hosted instances.
SQL injection in liketrek TREK's Journey Entry Update endpoint allows authenticated remote attackers to manipulate underlying database queries via the journeyService.updateEntry function in versions up to and including 3.0.22. The flaw (CWE-89) is network-reachable but requires a valid user session (PR:L), constraining the attack surface to authenticated users of self-hosted instances. No public exploit code or CISA KEV listing exists at time of analysis; the issue was privately disclosed alongside 17 other vulnerabilities all remediated in the 3.1.0 release.
Authentication bypass in liketrek TREK up to v3.0.22 allows a remote attacker with valid credentials to circumvent two-factor authentication by manipulating the mfa_token parameter in the Pre-2FA handler of the loginUser function (authService.ts). The CVSS 4.0 vector (PR:L) confirms low-privilege credentials are a prerequisite, meaning the bypass targets users who have valid username/password combinations but should still be blocked by a second factor. The vendor's own release notes for v3.1.0 describe this as a 'critical authentication bypass' - one of 18 privately reported security issues - and strongly recommend immediate upgrade for all self-hosted instances. No public exploit code or CISA KEV listing has been identified at time of analysis.
Insecure direct object reference in TREK collaborative travel planner before 3.1.3 allows any authenticated user with file-edit permission on any accessible trip to disclose reservation titles from private trips they do not own. By supplying attacker-controlled reservation_id, place_id, or assignment_id values to three file management API endpoints, the server joins the foreign reservation record in subsequent FILE_SELECT or getFileLinks() database queries and returns reservation_title in the response, crossing private trip boundaries. No public exploit code has been identified at time of analysis; vendor-released patch is confirmed in version 3.1.3.
Share-link token theft in TREK versions 3.0.0 through 3.0.x allows any ordinary authenticated user to exfiltrate private journey data belonging to other users. By iterating sequential journey IDs against the unguarded GET /api/journeys/:id/share-link endpoint, an attacker retrieves valid share tokens for journeys they do not own; those tokens then grant unauthenticated read access to the victim's travel entries, captions, GPS locations, moods, gallery photos, photo file paths, and asset identifiers via the public endpoint GET /api/public/journey/:token. No public exploit code or CISA KEV listing exists at time of analysis; the NVD CVSS scores this 6.5 medium, but the high confidentiality impact on personal travel data warrants prompt patching on any multi-tenant TREK deployment.
Server-Side Request Forgery in TREK, a collaborative travel planner, allows any authenticated user to pivot the server into making blind GET requests against loopback addresses, RFC 1918 internal networks, or cloud instance metadata endpoints (e.g., 169.254.169.254). The root cause is that importGoogleList(), importNaverList(), and resolveGoogleMapsUrl() validate only the initial submitted URL via checkSsrf() but then call native fetch() with redirect:'follow', bypassing DNS-pinned safeFetch() on redirect hops. No public exploit code or CISA KEV entry has been identified at time of analysis; the CVSS 4.0 score of 5.3 reflects the authenticated prerequisite and blind (non-reflective) nature of the SSRF.
Stored HTML injection in TREK collaborative travel planner (versions prior to 3.1.0) enables content spoofing and UI redress attacks against authenticated collaborators when the Journey add-on is enabled. An authenticated trip owner embeds raw HTML in a trip title; the backend endpoint GET /api/journeys/suggestions returns it unsanitized, and the frontend renders it directly via React's dangerouslySetInnerHTML, bypassing output encoding. The default Content Security Policy blocks inline handlers and script execution, constraining impact to visual manipulation rather than full cross-site scripting; no public exploit or active exploitation has been identified at time of analysis.
TREK collaborative travel planner versions before 2.7.2 serve uploaded user photos without authentication, allowing unauthenticated remote attackers to enumerate and access private photo collections through direct URL access. The vulnerability is restricted to information disclosure with low impact due to attack complexity constraints, though it exposes sensitive travel-related imagery that users expect to be private.
Authentication bypass in TREK collaborative travel planner (versions prior to 2.7.2) allows authenticated attackers with low privileges to access and modify trip photos without proper authorization. The missing authorization checks on Immich trip photo management routes enable unauthorized data access (high confidentiality impact) and limited integrity compromise. Exploitation requires authenticated access but no user interaction, exploitable remotely over network with low attack complexity.
Incorrect authorization in liketrek TREK's Journey Photo Proxy (all versions through 3.0.22) enables remote unauthenticated attackers to bypass share token validation in the `validateShareTokenForAsset` function, potentially exposing journey photos without a valid share token. The CVSS 4.0 score of 6.3 reflects high attack complexity that constrains practical exploitation despite requiring no authentication or user interaction. No public exploit code exists and this vulnerability is absent from the CISA KEV catalog; vendor-released patch v3.1.0 is available and strongly recommended for all self-hosted instances.
Path traversal in the liketrek TREK Public Journey Photo Proxy controller allows remote attackers - without authentication - to read files outside the intended directory on self-hosted instances running version 3.0.22 or earlier. The affected endpoint (`server/src/nest/journey/journey-public.controller.ts`) fails to adequately sanitize path inputs, exposing server-side files to limited confidentiality disclosure. No public exploit has been identified and the CVE is not listed in the CISA KEV catalog; a vendor-released patch is available in v3.1.0.
Improper authentication in liketrek TREK up to version 3.0.22 allows a remote unauthenticated attacker to bypass the OIDC login flow by exploiting flawed user-lookup logic in the `findOrCreateUser` function of `server/src/services/oidcService.ts`. Successful exploitation - rated high attack complexity - could allow an attacker to authenticate as an arbitrary user without valid credentials. No public exploit or CISA KEV listing exists; however, the vendor's v3.1.0 release notes describe this as a 'critical authentication bypass' among 18 privately-reported vulnerabilities, and updating is strongly recommended for all self-hosted instances.
SQL injection in liketrek TREK's Journey Entry Update endpoint allows authenticated remote attackers to manipulate underlying database queries via the journeyService.updateEntry function in versions up to and including 3.0.22. The flaw (CWE-89) is network-reachable but requires a valid user session (PR:L), constraining the attack surface to authenticated users of self-hosted instances. No public exploit code or CISA KEV listing exists at time of analysis; the issue was privately disclosed alongside 17 other vulnerabilities all remediated in the 3.1.0 release.
Authentication bypass in liketrek TREK up to v3.0.22 allows a remote attacker with valid credentials to circumvent two-factor authentication by manipulating the mfa_token parameter in the Pre-2FA handler of the loginUser function (authService.ts). The CVSS 4.0 vector (PR:L) confirms low-privilege credentials are a prerequisite, meaning the bypass targets users who have valid username/password combinations but should still be blocked by a second factor. The vendor's own release notes for v3.1.0 describe this as a 'critical authentication bypass' - one of 18 privately reported security issues - and strongly recommend immediate upgrade for all self-hosted instances. No public exploit code or CISA KEV listing has been identified at time of analysis.
Insecure direct object reference in TREK collaborative travel planner before 3.1.3 allows any authenticated user with file-edit permission on any accessible trip to disclose reservation titles from private trips they do not own. By supplying attacker-controlled reservation_id, place_id, or assignment_id values to three file management API endpoints, the server joins the foreign reservation record in subsequent FILE_SELECT or getFileLinks() database queries and returns reservation_title in the response, crossing private trip boundaries. No public exploit code has been identified at time of analysis; vendor-released patch is confirmed in version 3.1.3.
Share-link token theft in TREK versions 3.0.0 through 3.0.x allows any ordinary authenticated user to exfiltrate private journey data belonging to other users. By iterating sequential journey IDs against the unguarded GET /api/journeys/:id/share-link endpoint, an attacker retrieves valid share tokens for journeys they do not own; those tokens then grant unauthenticated read access to the victim's travel entries, captions, GPS locations, moods, gallery photos, photo file paths, and asset identifiers via the public endpoint GET /api/public/journey/:token. No public exploit code or CISA KEV listing exists at time of analysis; the NVD CVSS scores this 6.5 medium, but the high confidentiality impact on personal travel data warrants prompt patching on any multi-tenant TREK deployment.
Server-Side Request Forgery in TREK, a collaborative travel planner, allows any authenticated user to pivot the server into making blind GET requests against loopback addresses, RFC 1918 internal networks, or cloud instance metadata endpoints (e.g., 169.254.169.254). The root cause is that importGoogleList(), importNaverList(), and resolveGoogleMapsUrl() validate only the initial submitted URL via checkSsrf() but then call native fetch() with redirect:'follow', bypassing DNS-pinned safeFetch() on redirect hops. No public exploit code or CISA KEV entry has been identified at time of analysis; the CVSS 4.0 score of 5.3 reflects the authenticated prerequisite and blind (non-reflective) nature of the SSRF.
Stored HTML injection in TREK collaborative travel planner (versions prior to 3.1.0) enables content spoofing and UI redress attacks against authenticated collaborators when the Journey add-on is enabled. An authenticated trip owner embeds raw HTML in a trip title; the backend endpoint GET /api/journeys/suggestions returns it unsanitized, and the frontend renders it directly via React's dangerouslySetInnerHTML, bypassing output encoding. The default Content Security Policy blocks inline handlers and script execution, constraining impact to visual manipulation rather than full cross-site scripting; no public exploit or active exploitation has been identified at time of analysis.
TREK collaborative travel planner versions before 2.7.2 serve uploaded user photos without authentication, allowing unauthenticated remote attackers to enumerate and access private photo collections through direct URL access. The vulnerability is restricted to information disclosure with low impact due to attack complexity constraints, though it exposes sensitive travel-related imagery that users expect to be private.