Medium
liketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injection
Type: advisorySources: OSV
A vulnerability was determined in liketrek TREK up to 3.0.22. The affected element is the function journeyService.updateEntry of the file server/src/nest/journey/journey.controller.t of the component Journey Entry Update. This manipulation causes sql injection. It is possible to initiate the attack remotely. Upgrading to version 3.1.0 is sufficient to fix this issue. It is recommended to upgrade the affected component.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-78864
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 8 Nov 2026, 01:21 UTC · Revision 1
Source evidence
liketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injection
core-osv · Original sourcePublished 25 Aug 2026, 11:30 UTC
A vulnerability was determined in liketrek TREK up to 3.0.22. The affected element is the function journeyService.updateEntry of the file server/src/nest/journey/journey.controller.t of the component Journey Entry Update. This manipulation causes sql injection. It is possible to initiate the attack remotely. Upgrading to version 3.1.0 is sufficient to fix this issue. It is recommended to upgrade the affected component.
osv:CVE-2026-78864
Complete source record
{
"id": "69cc44bb495e862bfb8db11b01292b6ee0479dd966b8650c19fd001e3428540e",
"url": "https://osv.dev/vulnerability/CVE-2026-78864",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "liketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injection",
"summary": "A vulnerability was determined in liketrek TREK up to 3.0.22. The affected element is the function journeyService.updateEntry of the file server/src/nest/journey/journey.controller.t of the component Journey Entry Update. This manipulation causes sql injection. It is possible to initiate the attack remotely. Upgrading to version 3.1.0 is sufficient to fix this issue. It is recommended to upgrade the affected component.",
"evidence": "osv:CVE-2026-78864",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-78864",
"aliases": [
"CVE-2026-78864",
"GHSA-627x-pmfq-98qv"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/liketrek/trek",
"type": "GIT",
"events": [
{
"introduced": "523bca3a20595083f6d78b0de7c338fc208464d5"
},
{
"fixed": "f6af1d67a2630d77dcce39a92ac5599d08d7a5a1"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "3.0.0"
},
{
"last_affected": "3.0.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "3.0.1"
},
{
"last_affected": "3.0.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "3.0.2"
},
{
"last_affected": "3.0.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "3.0.3"
},
{
"last_affected": "3.0.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "3.0.4"
},
{
"last_affected": "3.0.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "3.0.5"
},
{
"last_affected": "3.0.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "3.0.6"
},
{
"last_affected": "3.0.6"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "3.0.7"
},
{
"last_affected": "3.0.7"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "3.0.8"
},
{
"last_affected": "3.0.8"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "3.0.9"
},
{
"last_affected": "3.0.9"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "3.0.10"
},
{
"last_affected": "3.0.10"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "3.0.11"
},
{
"last_affected": "3.0.11"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "3.0.12"
},
{
"last_affected": "3.0.12"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "3.0.13"
},
{
"last_affected": "3.0.13"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "3.0.14"
},
{
"last_affected": "3.0.14"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "3.0.15"
},
{
"last_affected": "3.0.15"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "3.0.16"
},
{
"last_affected": "3.0.16"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "3.0.17"
},
{
"last_affected": "3.0.17"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "3.0.18"
},
{
"last_affected": "3.0.18"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "3.0.19"
},
{
"last_affected": "3.0.19"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "3.0.20"
},
{
"last_affected": "3.0.20"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "3.0.21"
},
{
"last_affected": "3.0.21"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "3.0.22"
},
{
"last_affected": "3.0.22"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"fixed": "f6af1d67a2630d77dcce39a92ac5599d08d7a5a1"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v3.1.0"
}
]
}
}
],
"versions": [
"3.0.0",
"3.0.1",
"3.0.10",
"3.0.11",
"3.0.12",
"3.0.13",
"3.0.14",
"3.0.15",
"3.0.16",
"3.0.17",
"3.0.18",
"3.0.19",
"3.0.2",
"3.0.20",
"3.0.21",
"3.0.22",
"3.0.3",
"3.0.4",
"3.0.5",
"3.0.6",
"3.0.7",
"3.0.8",
"3.0.9",
"v3.0.22",
"v3.0.21",
"v3.0.20",
"v3.0.19",
"v3.0.18",
"v3.0.17",
"v3.0.16",
"v3.0.15",
"v3.0.14",
"v3.0.13",
"v3.0.12",
"v3.0.11",
"v3.0.10",
"v3.0.9",
"v3.0.8",
"v3.0.7",
"v3.0.6",
"v3.0.5",
"v3.0.4",
"v3.0.3",
"v3.0.2",
"v3.0.1",
"v3.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78864.json"
}
}
],
"modified": "2026-10-28T02:30:52.610404082Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78864.json",
"https://github.com/mauriceboe/TREK/security/advisories/GHSA-627x-pmfq-98qv",
"https://nvd.nist.gov/vuln/detail/CVE-2026-78864",
"https://vuldb.com/cve/CVE-2026-78864",
"https://vuldb.com/submit/886930",
"https://vuldb.com/vuln/394940",
"https://vuldb.com/vuln/394940/cti",
"https://github.com/liketrek/TREK/releases/tag/v3.1.0"
],
"provider_metadata": {
"cwe_ids": [
"CWE-74",
"CWE-89"
],
"cna_assigner": "VulDB",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78864.json"
}
},
"related_cves": [
{
"value": "CVE-2026-78864",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 521295,
"published_at": "2026-08-25T11:30:09.324+00:00"
}