Server-Side Request Forgery in TREK Travel Planner by TREK Technologies
CVE-2026-54508
5.3MEDIUM
What is CVE-2026-54508?
The TREK Travel Planner, prior to version 3.1.0, is vulnerable to Server-Side Request Forgery (SSRF) due to improper validation of URLs during the importing process. Specifically, the flaw lies in the importGoogleList() and importNaverList() functions, as well as the resolveGoogleMapsUrl() function. In these implementations, the application allows an unauthenticated attacker to craft a malicious URL, which can redirect the server to internal resources, including loopback or cloud metadata addresses, without adequate revalidation. This vulnerability can be exploited by any authenticated user, providing access to internal APIs that would ordinarily remain protected. The issue is resolved in version 3.1.0.
Affected Version(s)
TREK < 3.1.0