Read the docs
TI-2026-86059 Aliases CVE-2026-71495

Server-side request forgery in Wanderer trail download endpoint

Priority MEDIUM 43CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Wanderer by open-wanderer, a self-hosted trail database, is affected before 0.20.0. When PUBLIC_PRIVATE_INSTANCE is not set to true, the POST /api/v1/trail/download handler fetches a URL supplied by the requester and returns the response, a server-side request forgery flaw (CWE-918). A remote attacker without credentials can reach internal services and cloud metadata addresses, read the returned data, and perform internal network reconnaissance or denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service. This issue is fixed in version 0.20.0.

Why it matters now

EPSS 0.00336 27th percentileScored 2026-11-07
Fix Fixed wanderer (open-wanderer): 0.20.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
open-wandererwandererbefore 0.20.00.20.0Patch availableCNA
  • wanderer Vendoropen-wanderer Affected before 0.20.0 Fixed in 0.20.0 Patch available CNA

Remediation

Update Wanderer to version 0.20.0, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA wanderer (open-wanderer) Fixed in 0.20.0

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-71495

References

Other 4

  • TI-2026-86058 Stored XSS in Wanderer elevation profile via waypoint name and icon CVSS 3.1HIGH 7.6
  • TI-2026-86057 Stored XSS via waypoint icon in Wanderer map markers CVSS 3.1HIGH 7.6
  • TI-2026-86052 Wanderer ActivityPub endpoints expose private trails and comments CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences