CVE-2026-77294

The collaborative travel planner TREK is vulnerable to a Server-Side Request Forgery (SSRF) in versions prior to 3.3.0 . When the LLM_PARSING feature is enabled, an authenticated user with write permissions to a trip instance can store an attacker-controlled llm_base_url via the settings API. The...