Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service. This issue is fixed in version 0.20.0.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…nderer/security/advisories/GHSA-7vqq-mjjr-h9j5 Diğer
• github.com/open-wanderer/wanderer/pull/1104 Diğer
• github.com/…ommit/c371337b3db1d2895b5cad651046ef0ad4dfc802 Diğer
• github.com/open-wanderer/wanderer/releases/tag/v0.20.0 Diğer

Kayıt geçmişi

1. 6 Kas 2026 21:05Yayımlandı

İlgili açıklar

• 7,6 CVE-2026-62346Wanderer: Stored XSS via waypoint.name and waypoint.icon in Elevation Profile innerHTML
• 7,6 CVE-2026-62345Stored XSS via Unsanitized waypoint.icon in Map Marker (insertAdjacentHTML)
• 7,5 CVE-2026-62344Wanderer: Unauthenticated Access to Private Trails and Comments via ActivityPub Endpoints
• 6,5 CVE-2026-119758ERPNext OCR 1.1.1 Path Traversal and SSRF via read_document
• 5,0 CVE-2026-102356Kroki Mermaid companion SSRF via flowchart image URLs
• 8,2 CVE-2026-85743FreeScout: Server-side request forgery via incomplete outbound host validation and unguarded download sinks