Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-71495 (GCVE-0-2026-71495)

Vulnerability from cvelistv5 – Published: 2026-11-06 18:05 – Updated: 2026-11-09 13:13

Title

Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access

Summary

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service. This issue is fixed in version 0.20.0.

Severity

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 13:12 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA

References

4 references

URL	Tags
https://github.com/open-wanderer/wanderer/securit…	x_refsource_CONFIRM
https://github.com/open-wanderer/wanderer/pull/1104	x_refsource_MISC
https://github.com/open-wanderer/wanderer/commit/…	x_refsource_MISC
https://github.com/open-wanderer/wanderer/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
open-wanderer	wanderer	Affected: < 0.20.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-71495",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T13:12:32.342141Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T13:13:13.185Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/open-wanderer/wanderer/security/advisories/GHSA-7vqq-mjjr-h9j5"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "wanderer",
          "vendor": "open-wanderer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.20.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service. This issue is fixed in version 0.20.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T18:05:05.676Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-wanderer/wanderer/security/advisories/GHSA-7vqq-mjjr-h9j5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-wanderer/wanderer/security/advisories/GHSA-7vqq-mjjr-h9j5"
        },
        {
          "name": "https://github.com/open-wanderer/wanderer/pull/1104",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-wanderer/wanderer/pull/1104"
        },
        {
          "name": "https://github.com/open-wanderer/wanderer/commit/c371337b3db1d2895b5cad651046ef0ad4dfc802",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-wanderer/wanderer/commit/c371337b3db1d2895b5cad651046ef0ad4dfc802"
        },
        {
          "name": "https://github.com/open-wanderer/wanderer/releases/tag/v0.20.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-wanderer/wanderer/releases/tag/v0.20.0"
        }
      ],
      "source": {
        "advisory": "GHSA-7vqq-mjjr-h9j5",
        "discovery": "UNKNOWN"
      },
      "title": "Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-71495",
    "datePublished": "2026-11-06T18:05:05.676Z",
    "dateReserved": "2026-08-06T19:56:23.725Z",
    "dateUpdated": "2026-11-09T13:13:13.185Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-62346 (GCVE-0-2026-62346)

Vulnerability from cvelistv5 – Published: 2026-11-06 18:04 – Updated: 2026-11-06 18:04

Title

Wanderer: Stored XSS via waypoint.name and waypoint.icon in Elevation Profile innerHTML

Summary

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated local user can submit crafted waypoint.name and waypoint.icon values that the trail elevation graph interpolates into an innerHTML template in web/src/lib/vendor/maplibre-elevation-profile/elevationprofile.ts without HTML encoding or icon validation. A victim viewing the elevation profile executes the attacker-controlled script in their browser. Separately, federated waypoints can deliver the same malicious fields across instances without requiring the attacker to have a local account on the receiving instance. The script can expose session data or perform actions in the victim's context. This issue is fixed in version 0.19.3.

Severity

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA

References

4 references

URL	Tags
https://github.com/open-wanderer/wanderer/securit…	x_refsource_CONFIRM
https://github.com/open-wanderer/wanderer/pull/1093	x_refsource_MISC
https://github.com/open-wanderer/wanderer/commit/…	x_refsource_MISC
https://github.com/open-wanderer/wanderer/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
open-wanderer	wanderer	Affected: < 0.19.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "wanderer",
          "vendor": "open-wanderer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.19.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated local user can submit crafted waypoint.name and waypoint.icon values that the trail elevation graph interpolates into an innerHTML template in web/src/lib/vendor/maplibre-elevation-profile/elevationprofile.ts without HTML encoding or icon validation. A victim viewing the elevation profile executes the attacker-controlled script in their browser. Separately, federated waypoints can deliver the same malicious fields across instances without requiring the attacker to have a local account on the receiving instance. The script can expose session data or perform actions in the victim\u0027s context. This issue is fixed in version 0.19.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T18:04:02.389Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-wanderer/wanderer/security/advisories/GHSA-m7v2-6gj3-3g2p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-wanderer/wanderer/security/advisories/GHSA-m7v2-6gj3-3g2p"
        },
        {
          "name": "https://github.com/open-wanderer/wanderer/pull/1093",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-wanderer/wanderer/pull/1093"
        },
        {
          "name": "https://github.com/open-wanderer/wanderer/commit/6135332ea69a3d9a4fe1dec5af1cb1ee74f70e2b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-wanderer/wanderer/commit/6135332ea69a3d9a4fe1dec5af1cb1ee74f70e2b"
        },
        {
          "name": "https://github.com/open-wanderer/wanderer/releases/tag/v0.19.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-wanderer/wanderer/releases/tag/v0.19.3"
        }
      ],
      "source": {
        "advisory": "GHSA-m7v2-6gj3-3g2p",
        "discovery": "UNKNOWN"
      },
      "title": "Wanderer: Stored XSS via waypoint.name and waypoint.icon in Elevation Profile innerHTML"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62346",
    "datePublished": "2026-11-06T18:04:02.389Z",
    "dateReserved": "2026-07-13T21:42:50.095Z",
    "dateUpdated": "2026-11-06T18:04:02.389Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-62345 (GCVE-0-2026-62345)

Vulnerability from cvelistv5 – Published: 2026-11-06 18:03 – Updated: 2026-11-09 22:44

Title

Stored XSS via Unsanitized waypoint.icon in Map Marker (insertAdjacentHTML)

Summary

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint() passes into FontawesomeMarker, where insertAdjacentHTML inserts the unvalidated value into map marker markup. Opening the affected trail map executes attacker-controlled script in the viewer's browser, which can expose session tokens or perform actions as the victim. Federated waypoint data can also reach the sink without a local account on the receiving instance. This issue is fixed in version 0.19.3.

Severity

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 22:34 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA

References

4 references

URL	Tags
https://github.com/open-wanderer/wanderer/securit…	x_refsource_CONFIRM
https://github.com/open-wanderer/wanderer/pull/1093	x_refsource_MISC
https://github.com/open-wanderer/wanderer/commit/…	x_refsource_MISC
https://github.com/open-wanderer/wanderer/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
open-wanderer	wanderer	Affected: < 0.19.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-62345",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T22:34:59.830709Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T22:44:31.966Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "wanderer",
          "vendor": "open-wanderer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.19.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint() passes into FontawesomeMarker, where insertAdjacentHTML inserts the unvalidated value into map marker markup. Opening the affected trail map executes attacker-controlled script in the viewer\u0027s browser, which can expose session tokens or perform actions as the victim. Federated waypoint data can also reach the sink without a local account on the receiving instance. This issue is fixed in version 0.19.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T18:03:09.599Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-wanderer/wanderer/security/advisories/GHSA-hx3v-rv4v-w875",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-wanderer/wanderer/security/advisories/GHSA-hx3v-rv4v-w875"
        },
        {
          "name": "https://github.com/open-wanderer/wanderer/pull/1093",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-wanderer/wanderer/pull/1093"
        },
        {
          "name": "https://github.com/open-wanderer/wanderer/commit/6135332ea69a3d9a4fe1dec5af1cb1ee74f70e2b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-wanderer/wanderer/commit/6135332ea69a3d9a4fe1dec5af1cb1ee74f70e2b"
        },
        {
          "name": "https://github.com/open-wanderer/wanderer/releases/tag/v0.19.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-wanderer/wanderer/releases/tag/v0.19.3"
        }
      ],
      "source": {
        "advisory": "GHSA-hx3v-rv4v-w875",
        "discovery": "UNKNOWN"
      },
      "title": "Stored XSS via Unsanitized waypoint.icon in Map Marker (insertAdjacentHTML)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62345",
    "datePublished": "2026-11-06T18:03:09.599Z",
    "dateReserved": "2026-07-13T21:42:50.095Z",
    "dateUpdated": "2026-11-09T22:44:31.966Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-62344 (GCVE-0-2026-62344)

Vulnerability from cvelistv5 – Published: 2026-11-06 17:55 – Updated: 2026-11-06 17:55

Title

Wanderer: Unauthenticated Access to Private Trails and Comments via ActivityPub Endpoints

Summary

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, the unauthenticated GET /activitypub/trail/{id} and GET /activitypub/comment/{id} endpoints call ActivitypubTrail() and ActivitypubComment() to return full trail and comment records without applying the PocketBase collection view rules. An attacker who can enumerate or guess record IDs can retrieve private trail names, descriptions, GPS coordinates, GPX file URLs, photo URLs, and comments. This issue is fixed in version 0.19.3.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA

References

4 references

URL	Tags
https://github.com/open-wanderer/wanderer/securit…	x_refsource_CONFIRM
https://github.com/open-wanderer/wanderer/pull/1093	x_refsource_MISC
https://github.com/open-wanderer/wanderer/commit/…	x_refsource_MISC
https://github.com/open-wanderer/wanderer/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
open-wanderer	wanderer	Affected: < 0.19.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "wanderer",
          "vendor": "open-wanderer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.19.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, the unauthenticated GET /activitypub/trail/{id} and GET /activitypub/comment/{id} endpoints call ActivitypubTrail() and ActivitypubComment() to return full trail and comment records without applying the PocketBase collection view rules. An attacker who can enumerate or guess record IDs can retrieve private trail names, descriptions, GPS coordinates, GPX file URLs, photo URLs, and comments. This issue is fixed in version 0.19.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T17:55:48.323Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-wanderer/wanderer/security/advisories/GHSA-9qg7-jr2x-prvh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-wanderer/wanderer/security/advisories/GHSA-9qg7-jr2x-prvh"
        },
        {
          "name": "https://github.com/open-wanderer/wanderer/pull/1093",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-wanderer/wanderer/pull/1093"
        },
        {
          "name": "https://github.com/open-wanderer/wanderer/commit/6135332ea69a3d9a4fe1dec5af1cb1ee74f70e2b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-wanderer/wanderer/commit/6135332ea69a3d9a4fe1dec5af1cb1ee74f70e2b"
        },
        {
          "name": "https://github.com/open-wanderer/wanderer/releases/tag/v0.19.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-wanderer/wanderer/releases/tag/v0.19.3"
        }
      ],
      "source": {
        "advisory": "GHSA-9qg7-jr2x-prvh",
        "discovery": "UNKNOWN"
      },
      "title": "Wanderer: Unauthenticated Access to Private Trails and Comments via ActivityPub Endpoints"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62344",
    "datePublished": "2026-11-06T17:55:48.323Z",
    "dateReserved": "2026-07-13T21:42:50.095Z",
    "dateUpdated": "2026-11-06T17:55:48.323Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

4 vulnerabilities by open-wanderer

CVE-2026-71495 (GCVE-0-2026-71495)

CVE-2026-62346 (GCVE-0-2026-62346)

CVE-2026-62345 (GCVE-0-2026-62345)

CVE-2026-62344 (GCVE-0-2026-62344)