CVE-2026-78886: fallo de gravedad media en liketrek TREK
liketrek TREK Public Journey Photo Proxy journey-public.controller.ts path traversal
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.3epss 0.6%
A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/src/nest/journey/journey-public.controller.ts of the component Public Journey Photo Proxy. Performing a manipulation results in path traversal. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. Upgrading to version 3.1.0 mitigates this issue. It is advisable to upgrade the affected component.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
Productos afectados
liketrek · TREKCVEs relacionadas — liketrek TREK
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-78885MEDIUMliketrek TREK OIDC Service oidcService.ts findOrCreateUser improper authenticationEPSS 0.6%CVE-2026-78863MEDIUMliketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authenticationEPSS 0.5%CVE-2026-78887MEDIUMliketrek TREK Journey Photo Proxy validateShareTokenForAsset authorizationEPSS 0.5%CVE-2026-85738MEDIUMTREK: SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4)EPSS 0.4%CVE-2026-78864MEDIUMliketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injectionEPSS 0.3%