CVE-2026-78864: medium-severity vulnerability in liketrek TREK
liketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injection
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
A vulnerability was determined in liketrek TREK up to 3.0.22. The affected element is the function journeyService.updateEntry of the file server/src/nest/journey/journey.controller.t of the component Journey Entry Update. This manipulation causes sql injection. It is possible to initiate the attack remotely. Upgrading to version 3.1.0 is sufficient to fix this issue. It is recommended to upgrade the affected component.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
Affected products
liketrek · TREKRelated CVEs — liketrek TREK
In the same product, most dangerous first.
CVE-2026-78885MEDIUMliketrek TREK OIDC Service oidcService.ts findOrCreateUser improper authenticationEPSS 0.6%CVE-2026-78886MEDIUMliketrek TREK Public Journey Photo Proxy journey-public.controller.ts path traversalEPSS 0.6%CVE-2026-78863MEDIUMliketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authenticationEPSS 0.5%CVE-2026-78887MEDIUMliketrek TREK Journey Photo Proxy validateShareTokenForAsset authorizationEPSS 0.5%CVE-2026-85738MEDIUMTREK: SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4)EPSS 0.4%