CVE-2026-40184lowCWE-306

CVE-2026-40184: falha de baixa gravidade em mauriceboe TREK

Unauthenticated Access to Uploaded Files in TREK

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar TREK

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.7epss 0.2%
TREK is a collaborative travel planner. Prior to 2.7.2, TREK served uploaded photos without requiring authentication. This vulnerability is fixed in 2.7.2.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
mauriceboe · TREK
CVEs relacionadas — mauriceboe TREK

No mesmo produto, das mais perigosas para as menos.

CVE-2026-54505LOWTREK: Stored cross-user HTML injection via trip title in the Journey suggestion bannerEPSS 0.6%CVE-2026-54508MEDIUMTREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolutionEPSS 0.4%CVE-2026-54509MEDIUMTREK IDOR: any authenticated user can read another user's journey share token (full journey leak)EPSS 0.4%CVE-2026-77293HIGHTREK: Cross-user note-file deletion (IDOR / Broken Access Control)EPSS 0.4%CVE-2026-62945MEDIUMTREK: Cross-trip reservation title disclosure via file linksEPSS 0.3%CVE-2026-77294HIGHTREK: Server-Side Request Forgery via User-Configurable LLM Base URLEPSS 0.3%