CVE-2026-78864 Overview
CVE-2026-78864 is a SQL injection vulnerability in liketrek TREK versions up to 3.0.22. The flaw resides in the journeyService.updateEntry function within server/src/nest/journey/journey.controller.t, part of the Journey Entry Update component. Attackers can manipulate input to inject arbitrary SQL statements remotely against the backend database. Exploitation requires low-privilege authenticated access but no user interaction. The vendor addressed the issue in TREK version 3.1.0. The weakness is classified under CWE-74: Improper Neutralization of Special Elements in Output.
Critical Impact
Authenticated remote attackers can inject SQL through the Journey Entry Update endpoint, potentially exposing or altering database contents in TREK deployments up to version 3.0.22.
Affected Products
- liketrek TREK versions up to and including 3.0.22
- Component: Journey Entry Update (server/src/nest/journey/journey.controller.t)
- Function: journeyService.updateEntry
Discovery Timeline
- 2026-08-25 - CVE-2026-78864 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-78864
Vulnerability Analysis
The vulnerability exists in the updateEntry handler of the TREK NestJS backend. The application passes user-controlled input from the Journey Entry Update request into a database query without adequate parameterization or sanitization. An authenticated attacker with basic user privileges can craft input that alters the intended SQL query structure. Successful injection can lead to unauthorized data reads, tampering with journey records, or manipulation of related database rows. The attack proceeds over the network and does not require user interaction. Full technical details are tracked in the GitHub Security Advisory GHSA-627x-pmfq-98qv and the VulDB CVE-2026-78864 entry.
Root Cause
The root cause is improper neutralization of special elements passed to the SQL interpreter [CWE-74]. The journeyService.updateEntry function concatenates or interpolates untrusted input into a SQL query rather than binding it via parameterized queries or an ORM query builder with prepared statements.
Attack Vector
An authenticated remote attacker sends a crafted Journey Entry Update request containing SQL metacharacters in a controllable field. The backend embeds this input into a SQL statement executed against the TREK database, allowing the attacker to alter query semantics.
No verified public proof-of-concept is available. Refer to the GitHub Security Advisory GHSA-627x-pmfq-98qv for maintainer-provided technical context.
Detection Methods for CVE-2026-78864
Indicators of Compromise
- Unexpected SQL syntax fragments such as ', --, UNION, or OR 1=1 in HTTP request bodies targeting the Journey Entry Update endpoint.
- Database error responses or HTTP 500 codes returned from updateEntry calls following authenticated user actions.
- Anomalous modifications to journey table records that do not correlate with normal user activity.
Detection Strategies
- Enable application-layer logging for the TREK NestJS backend and inspect requests hitting the journeyService.updateEntry route for SQL metacharacters.
- Deploy a web application firewall with SQL injection signatures in front of TREK to flag or block suspicious payloads.
- Correlate authenticated user session activity with database audit logs to identify inconsistent query patterns.
Monitoring Recommendations
- Monitor authentication logs for accounts issuing high volumes of update requests to journey entries.
- Track database query error rates and long-running or malformed queries originating from the TREK application user.
- Alert on outbound data transfers or bulk reads from journey-related tables that deviate from baseline traffic.
How to Mitigate CVE-2026-78864
Immediate Actions Required
- Upgrade TREK to version 3.1.0 or later, which contains the fix. See the TREK v3.1.0 release notes.
- Audit application and database logs for signs of prior exploitation against the Journey Entry Update endpoint.
- Rotate credentials and review permissions for any accounts that may have been abused before the upgrade.
Patch Information
The maintainer released TREK version 3.1.0 to remediate CVE-2026-78864. Users should upgrade to this release or later. Details are available in the GitHub Security Advisory GHSA-627x-pmfq-98qv and VulDB Vulnerability #394940.
Workarounds
- Restrict access to the Journey Entry Update endpoint to trusted authenticated users only, pending the upgrade.
- Place a WAF rule in front of TREK that inspects request bodies for common SQL injection patterns targeting updateEntry.
- Apply least-privilege permissions on the database account used by TREK to limit the scope of any successful injection.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
