CVE-2026-54508

Name of the Vulnerable Software and Affected Versions TREK versions prior to 3.1.0

Description TREK fails to revalidate URLs during native redirect following in the importGoogleList() and importNaverList() functions within server/src/services/placeService.ts, and the resolveGoogleMapsUrl() function within server/src/services/mapsService.ts. While these functions call checkSsrf() from server/src/utils/ssrfGuard.ts, they subsequently use fetch() with the redirect: 'follow' configuration instead of the DNS-pinned safeFetch() path. This allows an attacker to use a public URL that redirects the server to loopback, RFC 1918, or cloud metadata addresses. Authenticated trip members can access list-import routes, and any authenticated user can access the /api/maps/resolve-url endpoint, enabling blind GET requests to internal services without response-body reflection. Server-Side Request Forgery (SSRF) is a flaw where a server is tricked into making requests to an unintended location.

Recommendations Update to version 3.1.0.