open-wanderer vulnerabilities and threats

CVE-2026-71495 is a critical server-side request forgery (SSRF) vulnerability in open-wanderer wanderer versions prior to 0.20.0. When the configuration PUBLIC_PRIVATE_INSTANCE is not set to true, unauthenticated attackers can exploit the POST /api/v1/trail/download endpoint by supplying a malicious JSON url field. This causes the server to fetch arbitrary internal network resources, potentially exposing sensitive data or enabling denial of service. The vulnerability is fixed in version 0.20.0.

CVE-2026-62346 is a high-severity cross-site scripting (XSS) vulnerability in open-wanderer wanderer versions prior to 0.19.3. Authenticated local users can submit crafted waypoint.name and waypoint.icon values that are improperly handled in the elevation profile rendering, leading to script execution in the browser of any victim viewing the profile. Additionally, federated waypoints can propagate this malicious input across instances without requiring local accounts on the target instance. The vulnerability allows attackers to expose session data or perform actions in the victim's context. The issue is fixed in version 0.19.3.

CVE-2026-62345 is a cross-site scripting (XSS) vulnerability in open-wanderer wanderer versions prior to 0.19.3. An authenticated user can inject malicious script via the waypoint.icon value, which is inserted without validation into map marker HTML. This script executes in the browser of anyone viewing the affected trail map, potentially exposing session tokens or allowing actions on behalf of the victim. Federated waypoint data can also trigger this without a local account on the receiving instance. The issue is fixed in version 0.19.3.

Wanderer versions prior to 0.19.3 have an authorization bypass vulnerability in unauthenticated GET endpoints that expose private trail and comment data without enforcing access controls. This allows attackers who can guess or enumerate record IDs to access sensitive information such as trail names, descriptions, GPS coordinates, GPX file URLs, photo URLs, and comments. The issue is fixed in version 0.19.3.