CVE-2026-54508: CWE-918: Server-Side Request Forgery (SSRF) in mauriceboe TREK

TREK versions before 3.1.0 have an SSRF vulnerability due to insufficient URL validation after initial checks in importGoogleList(), importNaverList(), and resolveGoogleMapsUrl() functions. These functions use fetch() with redirect: 'follow' instead of a DNS-pinned safeFetch(), allowing attacker-controlled URLs to redirect the server to internal network addresses without revalidation. Authenticated trip members can access list-import routes, and any authenticated user can access the /api/maps/resolve-url endpoint, enabling blind internal GET requests without response reflection. The vulnerability is addressed in version 3.1.0.

An attacker with authentication can cause the TREK server to make unauthorized internal network requests, potentially accessing sensitive internal services such as loopback interfaces, private IP ranges, or cloud metadata services. The requests are blind, meaning the attacker does not receive response content, but the SSRF could be leveraged for further internal reconnaissance or exploitation depending on the internal environment.

Upgrade TREK to version 3.1.0 or later, where this SSRF vulnerability is fixed. No other mitigation is required as the fix addresses the root cause by properly validating URLs and using safe fetch methods.