CVE-2026-78864: liketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injection
A vulnerability was determined in liketrek TREK up to 3.0.22. The affected element is the function journeyService.updateEntry of the file server/src/nest/journey/journey.controller.t of the component Journey Entry Update. This manipulation causes sql injection. It is possible to initiate the attack remotely. Upgrading to version 3.1.0 is sufficient to fix this issue. It is recommended to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
liketrek TREK Journey Entry Update (journey.controller.t / journeyService.updateEntry)to a version that resolves this vulnerability.Fixed in 3.1.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs privileges sufficient to invoke the Journey Entry Update functionality. The attack can be initiated remotely and does not require user interaction.
Which TREK versions are affected and what version fixes it?
liketrek TREK versions up to and including 3.0.22 are affected. Upgrading to version 3.1.0 fixes the vulnerability.
What should be done if an immediate upgrade is not possible?
The provided information recommends upgrading the affected component and does not specify an alternative mitigation. Until upgrading, restrict access to accounts and interfaces that can use Journey Entry Update.