by Kastro
Paper/Archive/CVE-2026-71495

CVE-2026-71495

open-wanderer wanderer — Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access

EPSS 0.3%CVSS 10.0
critical.is priorityof 100
35
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 27.2.272 × 205.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service. This issue is fixed in version 0.20.0.

Affected

ProductAffectedFixed inSource
wanderer< 0.20.0–CNA

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H

References

refgithub.com/open-wanderer/wanderer/security/advisories/GHSA-7vqq-mjjr-h9j5refgithub.com/open-wanderer/wanderer/pull/1104refgithub.com/open-wanderer/wanderer/commit/c371337b3db1d2895b5cad651046ef0ad4dfc802refgithub.com/open-wanderer/wanderer/releases/tag/v0.20.0