# CVE-2026-78886: liketrek TREK path traversal in public journey photo proxy

Source: https://junglewise.ai/threats/cve-2026-78886-liketrek-trek-path-traversal-in-public-journey-photo-proxy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78886 · Severity: low · CVSS 3.7 · Published 2026-08-25

liketrek TREK is a travel planning and expense-tracking application. A path traversal vulnerability in the public journey photo proxy allows anonymous users with a valid journey share token to bypass authentication and read sensitive files (PDFs, photos, avatars, cover images) that should be access-restricted. This bypasses the intended isolation between journeys and exposes private user data.

## Quick answers

**Is CVE-2026-78886 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78886 being exploited in the wild.

**How severe is CVE-2026-78886?** Low severity, with a CVSS score of 3.7, published 25 August 2026.

**Which products and versions are affected?** liketrek TREK up to 3.0.22.

**Is there a fix for CVE-2026-78886?** A patch was published on 2026-06-16: Fixed in version 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78886 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-78886?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the public journey photo proxy endpoint (GET /api/public/journey/:token/photo/local/:assetId/...) in journey-public.controller.ts. The vulnerable code fails to properly restrict the :assetId parameter to the /uploads/journey directory; a crafted assetId such as ..%2Ffiles%2F<uuid>.pdf (URL-decoded to ../files/...) allows escape into sibling directories (/uploads/files, /uploads/photos, /uploads/covers, /uploads/avatars). Combined with a permissive token fallback mechanism, an attacker with any valid journey share token can read authentication-gated files. Exploitation requires knowledge of server-generated UUID filenames (making it difficult), but successfully bypasses access controls and breaks journey-to-journey isolation. The vulnerability affects versions up to 3.0.22 and is fixed in 3.1.0 via path.basename() validation and containment checks.

## Affected products

- liketrek TREK up to 3.0.22

## Timeline

- 2026-06-16: disclosed
- 2026-06-16: patched: Fixed in version 3.1.0

## References

- [https://github.com/liketrek/TREK/releases/tag/v3.1.0](https://github.com/liketrek/TREK/releases/tag/v3.1.0)
- [https://github.com/mauriceboe/TREK/security/advisories/GHSA-h66w-m5g2-cqpc](https://github.com/mauriceboe/TREK/security/advisories/GHSA-h66w-m5g2-cqpc)