{"id":"CVE-2026-71495","published":"2026-11-06T19:17:56.657","lastModified":"2026-11-09T13:17:08.720","description":"Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service. This issue is fixed in version 0.20.0.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://github.com/open-wanderer/wanderer/commit/c371337b3db1d2895b5cad651046ef0ad4dfc802","tags":[]},{"url":"https://github.com/open-wanderer/wanderer/pull/1104","tags":[]},{"url":"https://github.com/open-wanderer/wanderer/releases/tag/v0.20.0","tags":[]},{"url":"https://github.com/open-wanderer/wanderer/security/advisories/GHSA-7vqq-mjjr-h9j5","tags":[]},{"url":"https://github.com/open-wanderer/wanderer/security/advisories/GHSA-7vqq-mjjr-h9j5","tags":[]}],"exploitRefs":[{"url":"https://github.com/open-wanderer/wanderer/commit/c371337b3db1d2895b5cad651046ef0ad4dfc802","tags":[]},{"url":"https://github.com/open-wanderer/wanderer/pull/1104","tags":[]},{"url":"https://github.com/open-wanderer/wanderer/releases/tag/v0.20.0","tags":[]},{"url":"https://github.com/open-wanderer/wanderer/security/advisories/GHSA-7vqq-mjjr-h9j5","tags":[]},{"url":"https://github.com/open-wanderer/wanderer/security/advisories/GHSA-7vqq-mjjr-h9j5","tags":[]}],"hasPoc":true,"ai":{"summary":"The unauthenticated POST /api/v1/trail/download endpoint in Wanderer prior to v0.20.0 allows SSRF by passing attacker-controlled URLs directly to event.fetch(), enabling access to internal services and metadata endpoints.","exploitability":"Exploitation is trivial for unauthenticated remote attackers; no user interaction or privileges required.","blast_radius":"Successful exploitation could expose sensitive internal service data (e.g., database, search), enable internal network reconnaissance, or cause denial of service via crafted requests to critical internal endpoints.","remediation":"Upgrade to Wanderer version 0.20.0 or later, which fixes the SSRF vulnerability in the /api/v1/trail/download endpoint.","detection":"Defenders should monitor for outbound HTTP/HTTPS requests from the application server to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost (127.0.0.1), or cloud metadata endpoints (e.g., 169.254.169.254) originating from the /api/v1/trail/download handler; logs may show unexpected external or internal domain resolution and fetch activity.","tags":["ssrf","web","no-auth","internal-recon"],"model":"garnet-coder","analyzedAt":"2026-11-07T09:43:13.455Z"}}