CVE-2026-62346

The Wanderer self-hosted trail database (prior to version 0.19.3 ) is vulnerable to Stored Cross-Site Scripting (XSS) . An authenticated local user can submit malicious waypoint.name and waypoint.icon values which are interpolated into an innerHTML template in web/src/lib/vendor/maplibre-elevatio...