Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

TREK — Vulnerabilities & Security Advisories 17

All 17 CVE vulnerabilities found in TREK, with AI-generated Chinese analysis, references, and POCs.

This page documents Common Weakness Enumerations associated with the TREK product developed by vendor TREK. It serves as a centralized aggregation of security flaws identified within the software ecosystem, specifically focusing on vulnerability data linked to this specific vendor and product combination. The content covers known security issues affecting TREK, including software flaws, configuration errors, and design weaknesses that have been publicly disclosed or tracked during the specified historical period. The data spans a defined timeframe, capturing both recent discoveries and legacy vulnerabilities that remain relevant for security assessment purposes. By consulting this aggregation, security professionals can track TREK’s advisory history to understand the vendor’s response patterns and patch deployment timelines. Users can also gain deeper insights into prevalent weakness classes within the product, allowing for better risk assessment and mitigation planning. Additionally, this resource enables the lookup of TREK’s vulnerability history, providing a comprehensive view of how security issues have evolved over time. This information supports informed decision-making regarding system updates, third-party risk management, and compliance auditing. The aggregation does not include speculative or unverified reports, ensuring that only confirmed and cataloged weaknesses are presented for analysis. This approach maintains integrity and reliability for users relying on the data for technical reviews or security posture evaluations.

Vendor: mauriceboe

CVE ID Title CVSS Severity Published
CVE-2026-85738 TREK: SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4) CWE-918 6.3 Medium 2026-09-24
CVE-2026-77293 TREK: Cross-user note-file deletion (IDOR / Broken Access Control) CWE-639 7.1 High 2026-09-24
CVE-2026-77320 TREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure) CWE-200 5.3 Medium 2026-09-24
CVE-2026-77321 TREK MCP trip summary bypasses delegated OAuth read scopes CWE-200 4.3 Medium 2026-09-24
CVE-2026-77294 TREK: Server-Side Request Forgery via User-Configurable LLM Base URL CWE-918 8.1 High 2026-09-24
CVE-2026-78887 liketrek TREK Journey Photo Proxy validateShareTokenForAsset authorization CWE-863 3.7 Low 2026-08-25
CVE-2026-78886 liketrek TREK Public Journey Photo Proxy journey-public.controller.ts path traversal CWE-22 3.7 Low 2026-08-25
CVE-2026-78885 liketrek TREK OIDC Service oidcService.ts findOrCreateUser improper authentication CWE-287 5.6 Medium 2026-08-25
CVE-2026-78864 liketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injection CWE-89 6.3 Medium 2026-08-25
CVE-2026-78863 liketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authentication CWE-287 6.3 Medium 2026-08-25
CVE-2026-62945 TREK: Cross-trip reservation title disclosure via file links CWE-639 4.3 Medium 2026-08-20
CVE-2026-54509 TREK IDOR: any authenticated user can read another user's journey share token (full journey leak) CWE-862 6.5 Medium 2026-08-20
CVE-2026-54508 TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution CWE-918 5.3 Medium 2026-08-20
CVE-2026-54505 TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner CWE-79 2.0 Low 2026-08-20
CVE-2026-45410 Time-based user enumeration in TREK authentication endpoint CWE-203 5.3 Medium 2026-05-28
CVE-2026-40185 Missing Authorization on Immich Trip Photo Routes in TREK CWE-862 7.1 High 2026-04-10
CVE-2026-40184 Unauthenticated Access to Uploaded Files in TREK CWE-306 3.7 Low 2026-04-10

All 17 known CVE vulnerabilities affecting TREK with full Chinese analysis, references, and POCs where available.