TREK vulnerabilities

2 known vulnerabilities in TREK from Mauriceboe. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  TREK: Server-Side Request Forgery

  CVE-2026-77294Sep 24, 2026Mauriceboe

  TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlled llm_base_url through the settings API when the LLM_PARSING feature is enabled. Write permission to the target trip instance is required to

• 7.1 High severity

  TREK: Authorization Bypass Through User-Controlled Key

  CVE-2026-77293Sep 24, 2026Mauriceboe

  TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.ts