CVE-2026-71495
Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access
CVSS Score
10.0
EPSS Score
0.0%
EPSS Percentile
0th
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service. This issue is fixed in version 0.20.0.
| CWE | CWE-918 |
| Vendor | open-wanderer |
| Product | wanderer |
| Published | Nov 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for open-wanderer wanderer
Be the first to know when new critical vulnerabilities affecting open-wanderer wanderer are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
High
Affected Versions
open-wanderer / wanderer
< 0.20.0
References
github.com: https://github.com/open-wanderer/wanderer/security/advisories/GHSA-7vqq-mjjr-h9j5 github.com: https://github.com/open-wanderer/wanderer/pull/1104 github.com: https://github.com/open-wanderer/wanderer/commit/c371337b3db1d2895b5cad651046ef0ad4dfc802 github.com: https://github.com/open-wanderer/wanderer/releases/tag/v0.20.0