Cross-Site Scripting Vulnerability in Wanderer Trail Database by Open Wanderer

CVE-2026-62346

What is CVE-2026-62346?

Wanderer, a self-hosted trail database, contains a vulnerability allowing authenticated local users to submit malicious waypoint names and icons. This can lead to Cross-Site Scripting (XSS) issues as these crafted values are rendered without HTML encoding or validation in a web application context. Users viewing the elevation profile risk executing attacker-controlled scripts in their browsers, potentially exposing session data or performing unauthorized actions. Notably, this vulnerability can also be exploited through federated waypoints, allowing cross-instance attacks without local account access. The issue was addressed in version 0.19.3.

References