CVE-2026-40184

TREK is a collaborative travel planner. Prior to 2.7.2, TREK served uploaded photos without requiring authentication. This vulnerability is fixed in 2.7.2.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/mauriceboe/TREK/commit/16277a3811a00c2983f7486fee83c112986cb179	Patch
https://github.com/mauriceboe/TREK/releases/tag/v2.7.2	Release Notes
https://github.com/mauriceboe/TREK/security/advisories/GHSA-wxx3-84fc-mrx2	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mauriceboe:trek:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) TREK es un planificador de viajes colaborativo. Antes de la versión 2.7.2, TREK servía fotos subidas sin requerir autenticación. Esta vulnerabilidad está corregida en la versión 2.7.2.

Information

Published : 2026-04-10 20:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-40184

Mitre link : CVE-2026-40184

CVE.ORG link : CVE-2026-40184

JSON object : View

Products Affected

mauriceboe

trek

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-40184", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40184", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T16:12:41.757685Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "mauriceboe", "product": "TREK", "versions": [{"status": "affected", "version": "< 2.7.2"}]}]}], "published": "2026-04-10T20:16:23.417", "references": [{"url": "https://github.com/mauriceboe/TREK/commit/16277a3811a00c2983f7486fee83c112986cb179", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mauriceboe/TREK/releases/tag/v2.7.2", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mauriceboe/TREK/security/advisories/GHSA-wxx3-84fc-mrx2", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "TREK is a collaborative travel planner. Prior to 2.7.2, TREK served uploaded photos without requiring authentication. This vulnerability is fixed in 2.7.2."}, {"lang": "es", "value": "TREK es un planificador de viajes colaborativo. Antes de la versi\u00f3n 2.7.2, TREK serv\u00eda fotos subidas sin requerir autenticaci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.7.2."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mauriceboe:trek:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0AC1A5B5-BB04-4ED4-ABC2-D87262232EFF", "versionEndIncluding": "2.7.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}