{"id":"CVE-2026-54508","title":"TREK is a collaborative travel planner","summary":"TREK is a collaborative travel planner. Prior to 3.1.0, TREK validates only the initial URL before native redirect following in importGoogleList() and importNaverList() in server/src/services/placeService.ts and resolveGoogleMapsUrl() in…","severity":"none","cwe":["CWE-918"],"published":"2026-08-20","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54508","references":[{"url":"https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11","label":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/pull/1185","label":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/releases/tag/v3.1.0","label":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/security/advisories/GHSA-f5vh-p2h5-x735","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.00313,"epssPercentile":0.24468,"ingestedAt":"2026-09-18T20:51:25.648Z","slug":"CVE-2026-54508","body":"## Overview\n\nTREK is a collaborative travel planner. Prior to 3.1.0, TREK validates only the initial URL before native redirect following in importGoogleList() and importNaverList() in server/src/services/placeService.ts and resolveGoogleMapsUrl() in server/src/services/mapsService.ts. The affected sinks call checkSsrf() from server/src/utils/ssrfGuard.ts and then use fetch() with redirect: 'follow' instead of the DNS-pinned safeFetch() path, so a public attacker-controlled URL can redirect the server to loopback, RFC 1918, or cloud metadata addresses without revalidation. An authenticated trip member can reach the list-import routes, and any authenticated user can reach /api/maps/resolve-url, allowing blind GET requests to internal services without response-body reflection. This issue is fixed in version 3.1.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}