Read the docs
TI-2026-58832 Aliases CVE-2026-85738

TREK: SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4)

Priority MEDIUM 61CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

TREK is a collaborative travel planner. Prior to 3.4.0, the checkSsrf logic in server/src/utils/ssrfGuard.ts does not recognize NAT64, 6to4, or Teredo IPv6 transition addresses that encode an IPv4 destination. An authenticated user who controls a DNS record can supply a URL whose AAAA result is a transition address embedding a private, loopback, or link-local IPv4 target, and isAlwaysBlocked and isPrivateNetwork classify the address as allowed. In a deployment that routes the applicable transition format, user-facing imports, webhooks, integrations, or plugin egress can reach internal services or cloud metadata and expose returned information. This issue is fixed in version 3.4.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00385 32nd percentileScored 2026-11-07
Fix Fixed TREK (liketrek): 3.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
liketrekTREKbefore 3.4.03.4.0Patch availableCNA
  • TREK Vendorliketrek Affected before 3.4.0 Fixed in 3.4.0 Patch available CNA

Remediation

  • Fix · CNA TREK (liketrek) Fixed in 3.4.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-85738

References

Other 4

  • TI-2026-54718 liketrek TREK Public Journey Photo Proxy journey-public.controller.ts path traversal CVSS 4.0MEDIUM 6.3
  • TI-2026-54717 liketrek TREK OIDC Service oidcService.ts findOrCreateUser improper authentication CVSS 4.0MEDIUM 6.3
  • TI-2026-54719 liketrek TREK Journey Photo Proxy validateShareTokenForAsset authorization CVSS 4.0MEDIUM 6.3
  • TI-2026-54715 liketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authentication CVSS 4.0MEDIUM 5.3
  • TI-2026-54716 liketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injection CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences