Description
TREK is a collaborative travel planner. Prior to 2.7.2, TREK served uploaded photos without requiring authentication. This vulnerability is fixed in 2.7.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| mauriceboe | TREK | < 2.7.2 | — |
Low · 3.7
CVE-2026-40184
EUVD-2026-21585
Unauthenticated Access to Uploaded Files in TREK
Published Apr 10, 2026 · Updated Apr 13, 2026 · Assigned by GitHub_M