CVE-2026-62945: TREK: Cross-trip reservation title disclosure via file links
TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservationid, placeid, and assignmentid values without using findForeignLinkTarget() to verify that the referenced object belongs to the file's trip. An authenticated user with file-edit permission on any accessible trip can submit a foreign reservation identifier through POST /api/trips/:tripId/files/:id/link, POST /api/trips/:tripId/files, or PUT /api/trips/:tripId/files/:id. Subsequent reads through FILESELECT or getFileLinks() join the foreign reservation and return reservationtitle, disclosing reservation existence and titles across private trip boundaries. This issue is fixed in version 3.1.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TREKto a version that resolves this vulnerability.Fixed in 3.1.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user needs file-edit permission on any trip they can access. They can then supply a reservation identifier belonging to a different trip when creating, updating, or linking a file.
What information can be exposed?
The issue can disclose the existence and titles of reservations in private trips outside the attacker’s authorized trip boundary. The provided data does not indicate disclosure of reservation contents beyond the title.
Which operations are affected?
The affected operations are file creation, file update, and file linking through POST /api/trips/:tripId/files, PUT /api/trips/:tripId/files/:id, and POST /api/trips/:tripId/files/:id/link. The vulnerable inputs include reservation_id, place_id, and assignment_id, although the described disclosure occurs when a foreign reservation is joined during later reads.
What should be done if immediate upgrading is not possible?
Restrict file-edit permission to trusted users on all accessible trips, since that permission is required for exploitation. Review file creation, update, and link requests for identifiers that reference objects outside the file’s trip.
How can administrators identify potentially affected data?
Review existing file links and file records for reservation_id, place_id, or assignment_id values that belong to a trip different from the associated file’s trip. Such cross-trip references may cause later file reads to return foreign reservation titles.