Is CVE-2026-78886 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78886 being exploited in the wild.

How severe is CVE-2026-78886?

Low severity, with a CVSS score of 3.7, published 25 August 2026.

Is there a fix for CVE-2026-78886?

A patch was published on 2026-06-16: Fixed in version 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-78886 attacked?

It is attacked over the network.

Am I affected by CVE-2026-78886?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78886: liketrek TREK path traversal in public journey photo proxy

CVE-2026-78886 · Severity: low · CVSS 3.7 · Published 2026-08-25

liketrek TREK is a travel planning and expense-tracking application. A path traversal vulnerability in the public journey photo proxy allows anonymous users with a valid journey share token to bypass authentication and read sensitive files (PDFs, photos, avatars, cover images) that should be access-restricted. This bypasses the intended isolation between journeys and exposes private user data.

Quick answers

Is CVE-2026-78886 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78886 being exploited in the wild.
How severe is CVE-2026-78886?: Low severity, with a CVSS score of 3.7, published 25 August 2026.
Which products and versions are affected?: liketrek TREK up to 3.0.22.
Is there a fix for CVE-2026-78886?: A patch was published on 2026-06-16: Fixed in version 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78886 attacked?: It is attacked over the network.
Am I affected by CVE-2026-78886?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in the public journey photo proxy endpoint (GET /api/public/journey/:token/photo/local/:assetId/...) in journey-public.controller.ts. The vulnerable code fails to properly restrict the :assetId parameter to the /uploads/journey directory; a crafted assetId such as ..%2Ffiles%2F<uuid>.pdf (URL-decoded to ../files/...) allows escape into sibling directories (/uploads/files, /uploads/photos, /uploads/covers, /uploads/avatars). Combined with a permissive token fallback mechanism, an attacker with any valid journey share token can read authentication-gated files. Exploitation requires knowledge of server-generated UUID filenames (making it difficult), but successfully bypasses access controls and breaks journey-to-journey isolation. The vulnerability affects versions up to 3.0.22 and is fixed in 3.1.0 via path.basename() validation and containment checks.

Affected products

liketrek TREK up to 3.0.22

Timeline

2026-06-16: disclosed
2026-06-16: patched: Fixed in version 3.1.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.