CVE-2026-71495
Wanderer is a self-hosted trail database for saving and sharing adventures
- Risk score
- 65/100
- CVSS
- 10.0 v3.1
- Published
- 6 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Wanderer's unauthenticated POST /api/v1/trail/download handler passes attacker-controlled JSON url field to event.fetch() and returns the fetched response, exposing internal network destinations and data. This allows internal network reconnaissance or denial of service.
- Affected
- {'products': ['Wanderer'], 'packages': [], 'versions': ['prior to 0.20.0']}
- Fix
- Upgrade to version 0.20.0
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 10.0 critical
- Remotely exploitable without logging in
References
Original description
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service. This issue is fixed in version 0.20.0.
Last activity 6 Nov 2026. Patch Forecast updates every hour.