CVE-2026-78886

Summary

A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/src/nest/journey/journey-public.controller.ts of the component Public Journey Photo Proxy. Performing a manipulation results in path traversal. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. Upgrading to version 3.1.0 mitigates this issue. It is advisable to upgrade the affected component.

Affected Software

VendorProductVersion RangeStatus
liketrekTREK3.0.0affected
liketrekTREK3.0.1affected
liketrekTREK3.0.2affected
liketrekTREK3.0.3affected
liketrekTREK3.0.4affected
liketrekTREK3.0.5affected
liketrekTREK3.0.6affected
liketrekTREK3.0.7affected
liketrekTREK3.0.8affected
liketrekTREK3.0.9affected
liketrekTREK3.0.10affected
liketrekTREK3.0.11affected
liketrekTREK3.0.12affected
liketrekTREK3.0.13affected
liketrekTREK3.0.14affected
liketrekTREK3.0.15affected
liketrekTREK3.0.16affected
liketrekTREK3.0.17affected
liketrekTREK3.0.18affected
liketrekTREK3.0.19affected
liketrekTREK3.0.20affected
liketrekTREK3.0.21affected
liketrekTREK3.0.22affected
liketrekTREK3.1.0unaffected

Weaknesses

  • CWE-22: Path Traversal

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References