161 matches found
EUVD-2026-63694
TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in...
CVE-2026-54505 TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner
TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in...
PT-2026-79187
Name of the Vulnerable Software and Affected Versions TREK versions prior to 3.1.0 Description TREK fails to revalidate URLs during native redirect following in the importGoogleList and importNaverList functions within server/src/services/placeService.ts, and the resolveGoogleMapsUrl function...
CVE-2026-62945: Authorization Bypass Through User-Controlled Key
TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservationid, placeid, and assignmentid values without using findForeignLinkTarget to verify that the referenced object belongs to the file's trip. An authenticated user...
PT-2026-79196
Name of the Vulnerable Software and Affected Versions TREK versions prior to 3.1.3 Description An authenticated user with file-edit permissions can disclose the existence and titles of reservations across private trip boundaries. The application fails to use the findForeignLinkTarget function to...
PT-2026-79186
TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in...
CVE-2026-54505: Improper Neutralization of Input During Web Page Generation
TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in...
CVE-2026-54509: Missing Authorization
TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...
PT-2026-79188
TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...
CVE-2026-54508: Server-Side Request Forgery (SSRF)
TREK is a collaborative travel planner. Prior to 3.1.0, TREK validates only the initial URL before native redirect following in importGoogleList and importNaverList in server/src/services/placeService.ts and resolveGoogleMapsUrl in server/src/services/mapsService.ts. The affected sinks call...
CVE-2026-45410
TREK is a collaborative travel planner. Prior to 3.0.18, early return on missing user during login flow allowed an attacker to enumerate valid user accounts via response timing discrepancy. When an email address existed in the database, the backend performed a bcrypt password comparison before...
CVE-2026-45410
TREK is a collaborative travel planner. Prior to 3.0.18, early return on missing user during login flow allowed an attacker to enumerate valid user accounts via response timing discrepancy. When an email address existed in the database, the backend performed a bcrypt password comparison before...
CVE-2026-45410 Time-based user enumeration in TREK authentication endpoint
TREK is a collaborative travel planner. Prior to 3.0.18, early return on missing user during login flow allowed an attacker to enumerate valid user accounts via response timing discrepancy. When an email address existed in the database, the backend performed a bcrypt password comparison before...
CVE-2026-45410 Time-based user enumeration in TREK authentication endpoint
TREK is a collaborative travel planner. Prior to 3.0.18, early return on missing user during login flow allowed an attacker to enumerate valid user accounts via response timing discrepancy. When an email address existed in the database, the backend performed a bcrypt password comparison before...
CVE-2026-45410
TREK (collaborative travel planner) has a time-based user enumeration vulnerability in the authentication endpoint prior to version 3.0.18. When an email exists, the backend performs a bcrypt password comparison before returning 401, adding ~370 ms; when it does not exist, it returns immediately ...
CVE-2026-45410 Time-based user enumeration in TREK authentication endpoint
TREK is a collaborative travel planner. Prior to 3.0.18, early return on missing user during login flow allowed an attacker to enumerate valid user accounts via response timing discrepancy. When an email address existed in the database, the backend performed a bcrypt password comparison before...
TREK 安全漏洞
TREK is a self-hosted, real-time collaboration travel planning tool developed by Maurice’s individual developer. It supports map management, budget tracking, and itinerary management. Versions of TREK prior to 3.0.18 contained security vulnerabilities. These vulnerabilities stemmed from the login...
PT-2026-44554
Name of the Vulnerable Software and Affected Versions TREK versions prior to 3.0.18 Description An issue in the login flow allows an attacker to enumerate valid user accounts by analyzing response timing discrepancies. When a provided email address exists in the database, the backend executes a...
CVE-2026-45410: Observable Discrepancy
TREK is a collaborative travel planner. Prior to 3.0.18, early return on missing user during login flow allowed an attacker to enumerate valid user accounts via response timing discrepancy. When an email address existed in the database, the backend performed a bcrypt password comparison before...