CVE-2026-71495
CRITICAL
INFO
Priority: 0.03
BB Relevance:
80/100
Published: 2026-11-06
Modified: 2026-11-12
First seen: 2026-11-06
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Changed
C:
High
I:
None
A:
High
Description
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service. This issue is fixed in version 0.20.0.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| open-wanderer | wanderer | < 0.20.0 |
| open-wanderer | wanderer | < 0.20.0 |
References & Advisories (4)
x_refsource_MISC
x_refsource_MISC
x_refsource_MISC
x_refsource_CONFIRM