Executive brief
liketrek TREK is a travel planning and expense-tracking application. A path traversal vulnerability in the public journey photo proxy allows anonymous users with a valid journey share token to bypass authentication and read sensitive files (PDFs, photos, avatars, cover images) that should be access-restricted. This bypasses the intended isolation between journeys and exposes private user data.
Technical details
A path traversal vulnerability exists in the public journey photo proxy endpoint (GET /api/public/journey/:token/photo/local/:assetId/...) in journey-public.controller.ts. The vulnerable code fails to properly restrict the :assetId parameter to the /uploads/journey directory; a crafted assetId such as ..%2Ffiles%2F<uuid>.pdf (URL-decoded to ../files/...) allows escape into sibling directories (/uploads/files, /uploads/photos, /uploads/covers, /uploads/avatars). Combined with a permissive token fallback mechanism, an attacker with any valid journey share token can read authentication-gated files. Exploitation requires knowledge of server-generated UUID filenames (making it difficult), but successfully bypasses access controls and breaks journey-to-journey isolation. The vulnerability affects versions up to 3.0.22 and is fixed in 3.1.0 via path.basename() validation and containment checks.
Affected products
- liketrek TREK up to 3.0.22
Timeline
- 2026-06-16: disclosed
- 2026-06-16: patched: Fixed in version 3.1.0