CVE-2026-40184 LOW

CVE-2026-40184: Unauthenticated Access to Uploaded Files in TREK

Vendor Mauriceboe

Product TREK

Weakness CWE-306 · Missing auth

Published April 10, 2026

Last update April 13, 2026

View on NVD All CVEs

CVSS base score

3.7/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

TREK is a collaborative travel planner. Prior to 2.7.2, TREK served uploaded photos without requiring authentication. This vulnerability is fixed in 2.7.2.

Key dates

02Disclosure timeline

April 10, 2026 CVE published

April 13, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-40184 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/306.html