Is CVE-2026-78864 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78864 being exploited in the wild.

How severe is CVE-2026-78864?

Medium severity, with a CVSS score of 6.3, published 25 August 2026.

Is there a fix for CVE-2026-78864?

A patch was published on 2026-06-16: Fixed in version 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-78864 attacked?

It is attacked over the network.

Am I affected by CVE-2026-78864?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78864: liketrek TREK SQL injection in journey entry update

CVE-2026-78864 · Severity: medium · CVSS 6.3 · Published 2026-08-25

TREK is a privacy-focused trip planning and expense-tracking application. A low-privilege authenticated user can inject SQL through unvalidated column names in the journey entry update endpoint, allowing them to read sensitive data from the entire database (including user passwords and encryption keys) and impersonate other trip authors. This could lead to account takeover and exposure of private trip information.

Quick answers

Is CVE-2026-78864 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78864 being exploited in the wild.
How severe is CVE-2026-78864?: Medium severity, with a CVSS score of 6.3, published 25 August 2026.
Which products and versions are affected?: liketrek TREK up to 3.0.22.
Is there a fix for CVE-2026-78864?: A patch was published on 2026-06-16: Fixed in version 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78864 attacked?: It is attacked over the network.
Am I affected by CVE-2026-78864?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a SQL injection in the journeyService.updateEntry function (PATCH /api/journeys/entries/:id in journey.controller.ts). The NestJS endpoint accepts raw request body keys without validation and constructs UPDATE statements using these keys directly in the SQL string (e.g., UPDATE journey_entries SET ${key} = ?), while only parameterizing values. An authenticated user can inject malicious column names containing subqueries to exfiltrate data from any table or mass-assign protected columns like author_id and visibility. The fix applies a column allow-list to the updateEntry function, mirroring the safe pattern already used elsewhere in the codebase. Patch is available in version 3.1.0.

Affected products

liketrek TREK up to 3.0.22

Timeline

2026-06-16: disclosed: Coordinated private disclosure reported by Gabriel ByteJMP
2026-06-16: patched: Fixed in version 3.1.0
2026-08-25: advisory: CVE-2026-78864 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.