TREK, a collaborative travel planner, had a flaw that allowed an authenticated user with write permission on a trip to store an attacker‑controlled llm_base_url value through the settings API when the LLM_PARSING feature was enabled. The server would later use this value when performing AI‑assisted trip parsing, initiating outbound requests to the supplied URL without a request forgery guard. The responses from those requests, including error messages, were returned to the user, exposing the network topology, internal service endpoints, and potentially cloud metadata that can contain credentials. This could enable an attacker to discover secrets or modify protected cloud resources.

TREK prior to version 3.3.0, including all deployments that enabled the LLM_PARSING feature, were vulnerable. The issue was resolved in the 3.3.0 release, so any version older than 3.3.0 without the patch is affected.

The flaw has a CVSS score of 8.1, indicating a high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated user who can write to a trip, and the attacker must also trigger the AI‑assisted import path. Even though exploitation requires those prerequisites, the potential to expose infrastructure credentials and alter cloud resources makes the risk significant. Vigilant monitoring and timely patching remain key to mitigating the threat.