Description
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service. This issue is fixed in version 0.20.0.
References
- www.cve.org/CVERecord ↗
- nvd.nist.gov/vuln/detail/CVE-2026-71495 ↗
- github.com/open-wanderer/wanderer/commit/c371337b3db1d2895b5cad651046ef0ad4dfc802 ↗
- github.com/open-wanderer/wanderer/pull/1104 ↗
- github.com/open-wanderer/wanderer/releases/tag/v0.20.0 ↗
- github.com/open-wanderer/wanderer/security/advisories/GHSA-7vqq-mjjr-h9j5 ↗
Related CVEs
← CVE Index: search every CVE from the last 30 days
This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.