CVE-2026-71495 Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access
CriticalCVSS 10.0
- Published
- Updated
- Exploit status
- No public exploit known
Description
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service. This issue is fixed in version 0.20.0.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| open-wanderer wanderer | = < 0.20.0 | No fix listed |