CVE-2026-71495: critical vulnerability in open-wanderer wanderer
Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
25Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 10
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service. This issue is fixed in version 0.20.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
Affected products
open-wanderer · wandererRelated CVEs — open-wanderer wanderer
In the same product, most dangerous first.
CVE-2026-62346HIGHWanderer: Stored XSS via waypoint.name and waypoint.icon in Elevation Profile innerHTMLEPSS —CVE-2026-62345HIGHStored XSS via Unsanitized waypoint.icon in Map Marker (insertAdjacentHTML)EPSS —CVE-2026-62344HIGHWanderer: Unauthenticated Access to Private Trails and Comments via ActivityPub EndpointsEPSS —