CVE-2026-62945: falha de média gravidade em mauriceboe TREK
TREK: Cross-trip reservation title disclosure via file links
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.3%
TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservation_id, place_id, and assignment_id values without using findForeignLinkTarget() to verify that the referenced object belongs to the file's trip. An authenticated user with file-edit permission on any accessible trip can submit a foreign reservation identifier through POST /api/trips/:tripId/files/:id/link, POST /api/trips/:tripId/files, or PUT /api/trips/:tripId/files/:id. Subsequent reads through FILE_SELECT or getFileLinks() join the foreign reservation and return reservation_title, disclosing reservation existence and titles across private trip boundaries. This issue is fixed in version 3.1.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
mauriceboe · TREKCVEs relacionadas — mauriceboe TREK
No mesmo produto, das mais perigosas para as menos.
CVE-2026-54505LOWTREK: Stored cross-user HTML injection via trip title in the Journey suggestion bannerEPSS 0.6%CVE-2026-54508MEDIUMTREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolutionEPSS 0.4%CVE-2026-54509MEDIUMTREK IDOR: any authenticated user can read another user's journey share token (full journey leak)EPSS 0.4%CVE-2026-77293HIGHTREK: Cross-user note-file deletion (IDOR / Broken Access Control)EPSS 0.4%CVE-2026-77294HIGHTREK: Server-Side Request Forgery via User-Configurable LLM Base URLEPSS 0.3%CVE-2026-77320MEDIUMTREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure)EPSS 0.3%