CVE-2026-77293

Received Received - Intake

Path Traversal in TREK Travel Planner

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description

TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.ts resolves the target only by note and file identifiers without requiring the file to belong to that trip. A user with edit access to any trip can submit identifiers belonging to another user's trip and permanently delete that note-file attachment. Sequential identifiers make broad targeting practical, while attachment read operations remain trip-scoped and are not affected. This issue is fixed in version 3.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-24

Generated

2026-09-25

AI Q&A

2026-09-25

EPSS Evaluated

N/A

NVD

CVE-2026-77293

EUVD

EUVD-2026-86341

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in TREK allows an authenticated user with edit access to any trip to delete note-file attachments belonging to another user's trip. The issue occurs because the DELETE endpoint authorizes users based on an attacker-controlled tripId but only checks note and file identifiers without verifying the file belongs to that trip.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized deletion of important note-file attachments in trips you manage. Attackers could target specific files or use sequential identifiers to delete multiple files across different trips, causing data loss and disrupting collaborative planning.

Compliance Impact

This vulnerability could lead to unauthorized deletion of user data, potentially violating GDPR's data integrity and HIPAA's access controls. Unauthorized users with edit access could delete attachments from other users' trips, compromising data availability and integrity.

Mitigation Strategies

Upgrade TREK to version 3.3.0 or later to address the authorization flaw in the DELETE endpoint for note files.

Hi! I’m here to help you understand CVE-2026-77293. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70