CVE-2026-78886
liketrek TREK Public Journey Photo Proxy journey-public.controller.ts path traversal
CVSS Score
3.7
EPSS Score
0.0%
EPSS Percentile
0th
A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/src/nest/journey/journey-public.controller.ts of the component Public Journey Photo Proxy. Performing a manipulation results in path traversal. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. Upgrading to version 3.1.0 mitigates this issue. It is advisable to upgrade the affected component.
| CWE | CWE-22 |
| Vendor | liketrek |
| Product | trek |
| Published | Aug 25, 2026 |
| Last Updated | Aug 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for liketrek trek
Be the first to know when new low vulnerabilities affecting liketrek trek are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
liketrek / TREK
3.0.0 3.0.1 3.0.2 3.0.3 3.0.4 3.0.5 3.0.6 3.0.7 3.0.8 3.0.9 3.0.10 3.0.11 3.0.12 3.0.13 3.0.14 3.0.15 3.0.16 3.0.17 3.0.18 3.0.19 3.0.20 3.0.21 3.0.22
References
vuldb.com: https://vuldb.com/vuln/394942 vuldb.com: https://vuldb.com/vuln/394942/cti vuldb.com: https://vuldb.com/cve/CVE-2026-78886 vuldb.com: https://vuldb.com/submit/886932 github.com: https://github.com/mauriceboe/TREK/security/advisories/GHSA-h66w-m5g2-cqpc github.com: https://github.com/liketrek/TREK/releases/tag/v3.1.0
Credits
🔍 ByteJMP (VulDB User)