{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-71495","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-08-06T19:56:23.725Z","datePublished":"2026-11-06T18:05:05.676Z","dateUpdated":"2026-11-06T18:05:05.676Z"},"containers":{"cna":{"title":"Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access","problemTypes":[{"descriptions":[{"cweId":"CWE-918","lang":"en","description":"CWE-918: Server-Side Request Forgery (SSRF)","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H","version":"3.1"}}],"references":[{"name":"https://github.com/open-wanderer/wanderer/security/advisories/GHSA-7vqq-mjjr-h9j5","tags":["x_refsource_CONFIRM"],"url":"https://github.com/open-wanderer/wanderer/security/advisories/GHSA-7vqq-mjjr-h9j5"},{"name":"https://github.com/open-wanderer/wanderer/pull/1104","tags":["x_refsource_MISC"],"url":"https://github.com/open-wanderer/wanderer/pull/1104"},{"name":"https://github.com/open-wanderer/wanderer/commit/c371337b3db1d2895b5cad651046ef0ad4dfc802","tags":["x_refsource_MISC"],"url":"https://github.com/open-wanderer/wanderer/commit/c371337b3db1d2895b5cad651046ef0ad4dfc802"},{"name":"https://github.com/open-wanderer/wanderer/releases/tag/v0.20.0","tags":["x_refsource_MISC"],"url":"https://github.com/open-wanderer/wanderer/releases/tag/v0.20.0"}],"affected":[{"vendor":"open-wanderer","product":"wanderer","versions":[{"version":"< 0.20.0","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-11-06T18:05:05.676Z"},"descriptions":[{"lang":"en","value":"Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service. This issue is fixed in version 0.20.0."}],"source":{"advisory":"GHSA-7vqq-mjjr-h9j5","discovery":"UNKNOWN"}}}}