Is CVE-2026-54508 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54508 being exploited in the wild.

How severe is CVE-2026-54508?

Informational severity, with a CVSS score of 0, published 20 August 2026.

Is there a fix for CVE-2026-54508?

A patch was published on 2026-06-16: Fixed in version 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54508 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-54508?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54508: TREK SSRF via redirect bypass in map URL resolution

CVE-2026-54508 · Severity: info · CVSS 0 · Published 2026-08-20

TREK is a collaborative travel planning application. Before version 3.1.0, the application fails to re-validate URLs after HTTP redirects when importing map data or resolving map URLs, allowing attackers to bypass security checks. An authenticated user could trick the server into making requests to internal services (on private networks or cloud metadata endpoints) that should be inaccessible, potentially exposing sensitive configuration or cloud credentials.

Quick answers

Is CVE-2026-54508 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54508 being exploited in the wild.
How severe is CVE-2026-54508?: Informational severity, with a CVSS score of 0, published 20 August 2026.
Which products and versions are affected?: TREK TREK prior to 3.1.0.
Is there a fix for CVE-2026-54508?: A patch was published on 2026-06-16: Fixed in version 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54508 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-54508?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) via incomplete URL validation in importGoogleList(), importNaverList() (in placeService.ts), and resolveGoogleMapsUrl() (in mapsService.ts). These functions validate the initial URL with checkSsrf() but then use fetch() with redirect: 'follow' instead of the DNS-pinned safeFetch() path, allowing an attacker-controlled public URL to redirect the server to loopback, RFC 1918 private, or cloud metadata addresses without re-validation. Trip members can reach list-import routes; any authenticated user can reach /api/maps/resolve-url, enabling blind GET requests to internal services. The fix in version 3.1.0 enforces safer redirect handling. Authentication is required; network access to the application is necessary.

Affected products

TREK TREK prior to 3.1.0

Timeline

2026-08-20: disclosed
2026-06-16: patched: Fixed in version 3.1.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.