CVE-2026-71495
CriticalCVSS 10.0Summary
In Wanderer prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service.
Risk Assessment
An unauthenticated attacker can use the server as a proxy to probe the internal network and access data from internal services or cloud metadata. This may lead to information disclosure and service disruption.
Recommendation
Update Wanderer to version 0.20.0 or later. If updating is not possible, set PUBLIC_PRIVATE_INSTANCE to true and restrict the server's network access to internal services.
Other vulnerabilities in Wanderer
See all- CVE-2026-62346High
In Wanderer prior to 0.19.3, an authenticated local user can submit crafted waypoint.name and waypoint.icon values that the trail elevation graph interpolates into an innerHTML template in web/src/lib/vendor/maplibre-elevation-profile/elevationprofile.ts without HTML encoding or icon validation. A victim viewing the elevation profile executes the attacker-controlled script in their browser. Separately, federated waypoints can deliver the same malicious fields across instances without requiring the attacker to have a local account on the receiving instance. The script can expose session data or perform actions in the victim's context.
- CVE-2026-62345High
In Wanderer prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint() passes into FontawesomeMarker, where insertAdjacentHTML inserts the unvalidated value into map marker markup. Opening the affected trail map executes attacker-controlled script in the viewer's browser, which can expose session tokens or perform actions as the victim. Federated waypoint data can also reach the sink without a local account on the receiving instance.
- CVE-2026-62344High
Wanderer prior to 0.19.3 exposes unauthenticated GET /activitypub/trail/{id} and GET /activitypub/comment/{id} endpoints that return full trail and comment records without applying PocketBase collection view rules. An attacker who can enumerate or guess record IDs can retrieve private trail names, descriptions, GPS coordinates, GPX file URLs, photo URLs, and comments.
Original NVD description (English source)
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service. This issue is fixed in version 0.20.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS