TREK Unauthenticated Photo Access Vulnerability

A vulnerability in TREK, a collaborative travel planner, prior to version 2.7.2, allowed uploaded photos to be accessed without authentication. This issue has been addressed in version 2.7.2. The vulnerability existed because the application served files from the '/uploads/photos' directory without requiring a valid authentication token or share token, leaving them exposed to any user.

Impact

Exploitation of this vulnerability allowed for unauthorized access to uploaded photos, which could be viewed or downloaded by any user.

Remediation

Users are advised to update TREK to version 2.7.2 or later, where this vulnerability has been fixed. The latest version can be downloaded from the TREK GitHub releases page.