CVE-2026-71495: fallo crítico en open-wanderer wanderer
Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
25Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 10
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service. This issue is fixed in version 0.20.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
Productos afectados
open-wanderer · wandererCVEs relacionadas — open-wanderer wanderer
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-62346HIGHWanderer: Stored XSS via waypoint.name and waypoint.icon in Elevation Profile innerHTMLEPSS —CVE-2026-62345HIGHStored XSS via Unsanitized waypoint.icon in Map Marker (insertAdjacentHTML)EPSS —CVE-2026-62344HIGHWanderer: Unauthenticated Access to Private Trails and Comments via ActivityPub EndpointsEPSS —