CVE-2026-71495
Unauthenticated SSRF in Wanderer before 0.20.0
- CVSS 3.1
- 10.0 critical
- EPSS
- —
- Published
- ·
- Modified
Wanderer prior to 0.20.0 has an SSRF flaw in the unauthenticated POST /api/v1/trail/download handler. When PUBLIC_PRIVATE_INSTANCE is not true, the attacker-controlled JSON url field is passed directly to event.fetch(), allowing requests to internal services such as db:8090 or external destinations. Attackers can exfiltrate internal data or mount a denial-of-service attack. All users of Wanderer before 0.20.0 are affected.
What to do: Upgrade to Wanderer 0.20.0. No workaround provided.
| Product | Affected | Fixed in |
|---|---|---|
| Wanderer | prior to 0.20.0 | 0.20.0 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service. This issue is fixed in version 0.20.0.
- Weakness
- CWE-918
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
In the news
0 storiesNo ingested article mentions this CVE yet.