CVE-2026-78864

Summary

A vulnerability was determined in liketrek TREK up to 3.0.22. The affected element is the function journeyService.updateEntry of the file server/src/nest/journey/journey.controller.t of the component Journey Entry Update. This manipulation causes sql injection. It is possible to initiate the attack remotely. Upgrading to version 3.1.0 is sufficient to fix this issue. It is recommended to upgrade the affected component.

Affected Software

VendorProductVersion RangeStatus
liketrekTREK3.0.0affected
liketrekTREK3.0.1affected
liketrekTREK3.0.2affected
liketrekTREK3.0.3affected
liketrekTREK3.0.4affected
liketrekTREK3.0.5affected
liketrekTREK3.0.6affected
liketrekTREK3.0.7affected
liketrekTREK3.0.8affected
liketrekTREK3.0.9affected
liketrekTREK3.0.10affected
liketrekTREK3.0.11affected
liketrekTREK3.0.12affected
liketrekTREK3.0.13affected
liketrekTREK3.0.14affected
liketrekTREK3.0.15affected
liketrekTREK3.0.16affected
liketrekTREK3.0.17affected
liketrekTREK3.0.18affected
liketrekTREK3.0.19affected
liketrekTREK3.0.20affected
liketrekTREK3.0.21affected
liketrekTREK3.0.22affected
liketrekTREK3.1.0unaffected

Weaknesses

  • CWE-89: SQL Injection
  • CWE-74: Injection

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References