CVE-2026-78886: liketrek TREK Path Traversal Vulnerability

CVE-2026-78886 Overview

CVE-2026-78886 is a path traversal vulnerability [CWE-22] in the liketrek TREK application affecting versions up to 3.0.22. The flaw resides in the Public Journey Photo Proxy component, specifically within server/src/nest/journey/journey-public.controller.ts. An unauthenticated remote attacker can manipulate input to traverse outside the intended directory and access files on the server. The vendor rates exploitation complexity as high and exploitability as difficult. Upgrading to version 3.1.0 resolves the issue.

Critical Impact

Remote unauthenticated attackers can read files outside the intended photo proxy directory by manipulating path parameters, potentially exposing sensitive server-side data.

Affected Products

• liketrek TREK versions up to and including 3.0.22
• Component: Public Journey Photo Proxy (journey-public.controller.ts)
• Fixed in TREK version 3.1.0

Discovery Timeline

• 2026-08-25 - CVE-2026-78886 published to NVD
• 2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78886

Vulnerability Analysis

The vulnerability exists in the Public Journey Photo Proxy component of TREK, an application maintained under the liketrek GitHub organization. The affected code path resides in server/src/nest/journey/journey-public.controller.ts, a NestJS controller that serves journey photos to unauthenticated clients. Because the endpoint is public, no authentication is required to reach the vulnerable handler.

An attacker can supply crafted input that traverses outside the intended asset directory. This behavior is characteristic of [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. Successful exploitation results in disclosure of files the process can read on the underlying host.

The vendor characterizes the attack complexity as high and the exploitability as difficult, indicating that specific conditions or knowledge of the deployment layout may be required to reach useful targets. The scope is limited to confidentiality; integrity and availability are not affected according to the published metrics.

Root Cause

The root cause is insufficient validation and canonicalization of user-supplied path input within the photo proxy handler. The controller appears to construct a filesystem path from request parameters without stripping traversal sequences such as ../ or resolving the canonical path and confirming it remains within an approved base directory.

Attack Vector

The attack is delivered over the network against the public journey endpoint. The attacker issues a crafted HTTP request to the photo proxy route with path parameters that reference locations outside the intended assets directory. No user interaction and no privileges are required. Refer to the GitHub Security Advisory GHSA-h66w-m5g2-cqpc and VulDB CVE-2026-78886 Details for further technical context.

Detection Methods for CVE-2026-78886

Indicators of Compromise

• HTTP requests to public journey photo proxy routes containing ../, ..%2f, ..%5c, or double-encoded traversal sequences.
• Access log entries showing responses returning content types inconsistent with expected image MIME types.
• Unexpected file reads by the TREK server process targeting configuration files, environment files, or SSH keys.

Detection Strategies

• Inspect application access logs for requests to journey photo endpoints referencing filenames outside the expected asset naming convention.
• Deploy web application firewall rules that flag encoded and unencoded directory traversal patterns on unauthenticated TREK routes.
• Correlate high-volume 200 OK responses from the photo proxy with atypical file sizes indicating non-image payloads.

Monitoring Recommendations

• Enable verbose HTTP request logging on any reverse proxy fronting the TREK backend to capture full URIs.
• Monitor filesystem access from the Node.js/NestJS process for reads outside the configured media directory.
• Alert on repeated 4xx and 5xx responses from the public journey controller, which can indicate probing.

How to Mitigate CVE-2026-78886

Immediate Actions Required

• Upgrade TREK to version 3.1.0 or later using the GitHub TREK v3.1.0 Release.
• Inventory all internet-exposed TREK deployments and confirm the running version.
• Review recent access logs for the public journey photo proxy for signs of traversal probing.

Patch Information

The maintainer resolved this issue in TREK 3.1.0. Administrators should pull the tagged release from the GitHub TREK v3.1.0 Release and redeploy. Consult the GitHub Security Advisory GHSA-h66w-m5g2-cqpc for advisory-level details.

Workarounds

• Restrict access to the public journey photo proxy route at the reverse proxy or WAF layer until patching is complete.
• Add ingress rules that reject request paths containing traversal sequences, including URL-encoded and double-encoded variants.
• Run the TREK server process under a low-privilege account with filesystem access restricted to the media directory.

# Example nginx rule to block traversal patterns on the photo proxy route
location /api/journey/ {
    if ($request_uri ~* "(\.\./|\.\.%2f|\.\.%5c|%2e%2e/)") {
        return 400;
    }
    proxy_pass http://trek_backend;
}