CVE-2026-85738 Details
Description
TREK is a collaborative travel planner. Prior to 3.4.0, the checkSsrf logic in server/src/utils/ssrfGuard.ts does not recognize NAT64, 6to4, or Teredo IPv6 transition addresses that encode an IPv4 destination. An authenticated user who controls a DNS record can supply a URL whose AAAA result is a transition address embedding a private, loopback, or link-local IPv4 target, and isAlwaysBlocked and isPrivateNetwork classify the address as allowed. In a deployment that routes the applicable transition format, user-facing imports, webhooks, integrations, or plugin egress can reach internal services or cloud metadata and expose returned information. This issue is fixed in version 3.4.0.
A server-side request forgery (SSRF) vulnerability has been identified in TREK, a collaborative travel planning application, prior to version 3.4.0. The issue arises because the application's SSRF protection does not recognize certain IPv6 transition addresses that embed private or loopback IPv4 destinations. An authenticated user controlling a DNS record can exploit this by directing a URL to a transition address that, when resolved, bypasses the SSRF guard and accesses internal services or cloud metadata, potentially exposing sensitive information. This vulnerability is particularly concerning in environments that route these transition formats, as it can lead to unauthorized access to internal services or cloud metadata.
Users can update to TREK version 3.4.0, where this vulnerability has been fixed. The update includes enhancements to the SSRF guard that recognize and properly handle IPv6 transition addresses, preventing them from being used to access internal services or cloud metadata.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/liketrek/TREK/commit/a2bd9be184a94997105ce190dad920c41e7b10df | [email protected] | Source CodeVendor |
| https://github.com/liketrek/TREK/pull/1540 | [email protected] | Issue TrackingVendor |
| https://github.com/liketrek/TREK/releases/tag/v3.4.0 | [email protected] | Release NotesVendor |
| https://github.com/liketrek/TREK/security/advisories/GHSA-9hpq-mrpx-mcxg | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TREK | < 3.3.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | New CVE Received | [email protected] |