CVE-2026-78886CWE-22path-traversal

CVE-2026-78886

Low · published August 25, 2026

CVSS v3.1
3.7
EPSS
1%
Percentile
46.9
In the wild
Unconfirmed
What it is

A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/src/nest/journey/journey-public.controller.ts of the component Public Journey Photo Proxy. Performing a manipulation results in path traversal. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. Upgrading to version 3.1.0 mitigates this issue. It is advisable to upgrade the affected component.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
EPSS
0.00580 · 46.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-25T17:19Z
References (6)
https://github.com/liketrek/TREK/releases/tag/v3.1.0 · [email protected]https://github.com/mauriceboe/TREK/security/advisories/GHSA-h66w-m5g2-cqpc · [email protected]https://vuldb.com/cve/CVE-2026-78886 · [email protected]https://vuldb.com/submit/886932 · [email protected]https://vuldb.com/vuln/394942 · [email protected]https://vuldb.com/vuln/394942/cti · [email protected]
EPSS history
Timeline
  • 27 AUG 06:46Z
    EPSS moved — → 0%
    epss
  • 25 AUG 12:30Z
    liketrek TREK Public Journey Photo Proxy journey-public.controller.ts path traversal
    cvelistv5