CVE-2026-78886 in TREK
Summary
by MITRE • 08/25/2026
A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/src/nest/journey/journey-public.controller.ts of the component Public Journey Photo Proxy. Performing a manipulation results in path traversal. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. Upgrading to version 3.1.0 mitigates this issue. It is advisable to upgrade the affected component.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
A critical security vulnerability has been identified within liketrek TREK software, specifically affecting versions up through 3.0.22. This flaw resides in a specific function associated with the Public Journey Photo Proxy component, located technically at file server/src/nest/journey/journey-public.controller.ts. The nature of this defect is classified as a path traversal vulnerability, which represents a significant risk to system integrity and data confidentiality. Path traversal attacks allow an attacker to access files and directories that are stored outside the web root folder, potentially exposing sensitive information or allowing for further exploitation depending on server configuration.
The technical mechanism behind this flaw involves insufficient validation of user-supplied input within the public journey photo proxy functionality. When a remote actor interacts with this component by manipulating request parameters, they can inject directory traversal sequences such as dot-dot-slash characters into the file path arguments. Because the application fails to properly sanitize or canonicalize these inputs before processing them against the local filesystem, it inadvertently resolves paths that lead outside of intended directories. This lack of strict input validation and boundary checking is a fundamental design error in how the server handles resource requests for public journey photos.
From an operational perspective, this vulnerability allows for remote exploitation without requiring prior authentication or complex setup conditions on the part of the attacker, although the complexity of executing a successful attack is rated as high. This rating suggests that while the vector is open to network-based attacks, specific environmental factors or precise payload construction may be required to achieve the desired outcome consistently. The exploitability being reported as difficult indicates that automated tools might struggle with this flaw without significant tuning, yet skilled attackers can still leverage it effectively. If successful, an attacker could potentially read sensitive configuration files, source code, or other private data stored on the server, leading to a breach of confidentiality and potentially compromising the entire application environment if combined with other vulnerabilities.
In alignment with industry standards, this vulnerability maps directly to CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This classification highlights the failure to enforce strict boundaries when accessing files on an operating system. Furthermore, from a tactical standpoint within the MITRE ATT&CK framework, this behavior aligns with techniques related to Collection and Exfiltration over Alternative Protocol or Local File Input Capture, where adversaries seek to access local resources that are not directly exposed through normal application interfaces but can be reached via manipulated paths. Understanding these mappings helps in categorizing the risk profile accurately for compliance and reporting purposes.
To mitigate this vulnerability immediately, organizations running liketrek TREK versions up to 3.0.22 should prioritize upgrading to version 3.1.0 or later as soon as possible. The vendor has addressed the underlying code defect in newer releases by implementing stricter input validation mechanisms that sanitize file paths and restrict access to only authorized directories. Until an upgrade can be performed, administrators may consider applying network-level controls such as web application firewalls configured to detect and block common path traversal patterns like dot-dot-slash sequences in HTTP requests targeting this specific endpoint. Additionally, reviewing server configurations to ensure the web root is properly isolated from sensitive data stores provides a layer of defense-in-depth that limits the impact even if an exploitation attempt succeeds. Regular security audits and code reviews focusing on file handling operations are recommended to prevent similar issues in future development cycles.