The vulnerability allows an authenticated user who can control a DNS record to supply a URL that resolves to an IPv6 transition address—such as NAT64, 6to4, or Teredo. The server’s SSRF guard incorrectly classifies these transition addresses as allowed, enabling the request to be forwarded to the embedded IPv4 target. As a result, the application can reach private, loopback, or link‑local addresses inside the network or access cloud metadata endpoints, exposing sensitive data that would otherwise be inaccessible from the application’s context.

The issue affects the TREK collaborative travel planner from liketrek, any version prior to 3.4.0. Version 3.4.0 and later contain the fix that correctly rejects transition addresses in the SSRF guard logic.

The CVSS score is 6.3 (moderate), with no EPSS value available and not listed in CISA’s KEV catalog. The likely attack vector requires an authenticated user who can alter DNS records; once the transition address is in place, the system behaves as if a normal outbound request is permitted. While the vulnerability does not grant arbitrary code execution, it enables internal network access and potential leakage of metadata, placing internal services at risk. The exploitation complexity is moderate, but the impact is significant for organizations that expose internal services or rely on outbound configuration plugins.