External risk intelligence

Wanderer Unauthenticated Download Handler Allows Internal Network Access

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-71495

Wanderer is a self-hosted trail database designed for saving and sharing adventures. As a web application intended for sharing content, it is commonly deployed as an internet-facing service. The vulnerability exists in a public API endpoint, which is reachable in standard deployments where the application is exposed to the internet to facilitate its primary function.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Wanderer trail database software could allow unauthenticated access to internal network resources and sensitive data. This occurs when a specific configuration is not in place, and the software improperly handles URLs provided by users, potentially exposing information from internal services or cloud metadata.

Unauthenticated access to internal network data.
Matters for protecting sensitive shared adventure data.
Confirm relevance; focus on internal network exposure.

Attack Path

How an attacker could exploit the issue

An attacker can send a request to a publicly accessible download endpoint, which, if the instance is not configured for private use, will forward the request to internal network services. This allows an attacker to probe internal systems and potentially exfiltrate sensitive data or disrupt services.

Unauthenticated access to download API.
URL field in POST request.
Internal network exposure and reconnaissance.

Live Threat

Current exploitation, exposure, and threat context

When the instance is not configured for private use, an unauthenticated user could leverage a vulnerability in the trail download handler to interact with internal services or cloud metadata addresses. This interaction could expose data returned from these requests and enable network reconnaissance or denial of service, under conditions where the instance is accessible externally and the security setting is not enabled.

Internal service data or cloud metadata.
Via unauthenticated API calls to internal hosts.
Leads to data exposure and network reconnaissance.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given Wanderer is a self-hosted application often exposed externally for sharing, the platform or infrastructure team managing the deployment is likely responsible for addressing this vulnerability. The first practical step involves identifying all instances of Wanderer, confirming their reachability and business criticality, and then assigning an owner for remediation planning.

Platform/Infrastructure team owns the issue.
Verify internal network reachability and asset criticality.
Plan and execute the upgrade to a patched version.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Wanderer and what does it do?

Wanderer is a self-hosted software application designed for users to store, manage, and share details about their outdoor adventures and trails. Because it is built to facilitate sharing, individuals and organizations typically host it as a web service that is accessible to others.

What is the vulnerability in CVE-2026-71495?

This CVE involves a Server-Side Request Forgery (SSRF) weakness. Essentially, the software fails to properly validate destination addresses provided by users in an API request. This allows an attacker to trick the application into making requests on their behalf to unintended locations, such as private internal services or cloud metadata endpoints.

How can an attacker trigger this bug?

An attacker can trigger the issue by sending an unauthenticated POST request to the download API endpoint with a specific URL field. This flaw does not occur if the application has been configured with the 'PUBLIC_PRIVATE_INSTANCE' setting enabled, as this configuration acts as a safeguard against these types of unauthorized external requests.

Do I need to worry about this if my Wanderer instance is public?

Yes, you should be concerned. According to Halo Surface Signal, because Wanderer is designed to share content, it is frequently deployed as an internet-facing service. If your instance is exposed to the internet and lacks the specific private configuration, the API is reachable by anyone, potentially allowing them to probe your internal network.

How should I respond to this security flaw?

The most effective first step is to locate all instances of Wanderer within your environment to determine which are internet-facing. Once identified, prioritize updating these installations to version 0.20.0 or later, which contains the fix for the improper URL handling.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.