CVE-2026-54508: TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution
TREK is a collaborative travel planner. Prior to 3.1.0, TREK validates only the initial URL before native redirect following in importGoogleList() and importNaverList() in server/src/services/placeService.ts and resolveGoogleMapsUrl() in server/src/services/mapsService.ts. The affected sinks call checkSsrf() from server/src/utils/ssrfGuard.ts and then use fetch() with redirect: 'follow' instead of the DNS-pinned safeFetch() path, so a public attacker-controlled URL can redirect the server to loopback, RFC 1918, or cloud metadata addresses without revalidation. An authenticated trip member can reach the list-import routes, and any authenticated user can reach /api/maps/resolve-url, allowing blind GET requests to internal services without response-body reflection. This issue is fixed in version 3.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TREKto a version that resolves this vulnerability.Fixed in 3.1.0
Event History
Frequently Asked Questions
Which users can trigger the vulnerable requests?
Any authenticated user can use /api/maps/resolve-url. The Google and Naver list-import routes require the user to be an authenticated member of the relevant trip.
What does an attacker need to exploit this issue?
The attacker needs an authenticated TREK account and control of a publicly reachable URL that passes the initial SSRF check, then redirects to an internal destination. For list imports, they also need membership in the target trip.
Are internal response contents exposed to the attacker?
The issue enables blind GET requests to internal services; response bodies are not reflected. An attacker may still use request behavior to probe or interact with reachable loopback, private-network, or cloud metadata endpoints.
What should be done if upgrading is not immediately possible?
Restrict access to the affected URL-resolution and list-import functionality to trusted authenticated users, and prevent the TREK server from reaching loopback, RFC 1918, and cloud metadata address ranges through network egress controls. Upgrade to version 3.1.0 when possible.