Skip to content
OpenAdvisories

Vendor

mauriceboe

11 known vulnerabilities.

Products

TREK 11
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.1
    CVE-2026-77293

    TREK: Cross-user note-file deletion (IDOR / Broken Access Control)

    TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.t…

    mauriceboe TREK
  • High 8.1
    CVE-2026-77294

    TREK: Server-Side Request Forgery via User-Configurable LLM Base URL

    TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlled llm_base_url through the settings API when the LLM_PARSING feature is enabled. Write permission to the target trip instance is required t…

    mauriceboe TREK
  • High 7.1
    CVE-2026-40185

    Missing Authorization on Immich Trip Photo Routes in TREK

    TREK is a collaborative travel planner. Prior to 2.7.2, TREK was missing authorization checks on the Immich trip photo management routes. This vulnerability is fixed in 2.7.2.

    mauriceboe TREK