CVE-2026-85738mediumCWE-918

CVE-2026-85738: falha de média gravidade em liketrek TREK

TREK: SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4)

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar TREK

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.4%
TREK is a collaborative travel planner. Prior to 3.4.0, the checkSsrf logic in server/src/utils/ssrfGuard.ts does not recognize NAT64, 6to4, or Teredo IPv6 transition addresses that encode an IPv4 destination. An authenticated user who controls a DNS record can supply a URL whose AAAA result is a transition address embedding a private, loopback, or link-local IPv4 target, and isAlwaysBlocked and isPrivateNetwork classify the address as allowed. In a deployment that routes the applicable transition format, user-facing imports, webhooks, integrations, or plugin egress can reach internal services or cloud metadata and expose returned information. This issue is fixed in version 3.4.0.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Produtos afetados
liketrek · TREK
CVEs relacionadas — liketrek TREK

No mesmo produto, das mais perigosas para as menos.

CVE-2026-78885MEDIUMliketrek TREK OIDC Service oidcService.ts findOrCreateUser improper authenticationEPSS 0.6%CVE-2026-78886MEDIUMliketrek TREK Public Journey Photo Proxy journey-public.controller.ts path traversalEPSS 0.6%CVE-2026-78863MEDIUMliketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authenticationEPSS 0.5%CVE-2026-78887MEDIUMliketrek TREK Journey Photo Proxy validateShareTokenForAsset authorizationEPSS 0.5%CVE-2026-78864MEDIUMliketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injectionEPSS 0.3%