Skip to content
Heist/ feed
Medium

TREK: SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4)

Type: advisorySource: Official CVE List1 source record

TREK is a collaborative travel planner. Prior to 3.4.0, the checkSsrf logic in server/src/utils/ssrfGuard.ts does not recognize NAT64, 6to4, or Teredo IPv6 transition addresses that encode an IPv4 destination. An authenticated user who controls a DNS record can supply a URL whose AAAA result is a transition address embedding a private, loopback, or link-local IPv4 target, and isAlwaysBlocked and isPrivateNetwork classify the address as allowed. In a deployment that routes the applicable transition format, user-facing imports, webhooks, integrations, or plugin egress can reach internal services or cloud metadata and expose returned information. This issue is fixed in version 3.4.0.

Announced Source revision 1
Original source ↗

CVE-2026-85738

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-85738

TREK

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "liketrek",
    "product": "TREK",
    "versions": [
      {
        "status": "affected",
        "version": "< 3.4.0"
      }
    ]
  }
]
Related CVEs
CVE-2026-85738

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event
#3150 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement