CVE-2026-71495 | open-wanderer Wanderer up to 0.19.x Download /api/v1/trail/download event.fetch url server-side request forgery

November 6, 2026 Yanac

A vulnerability was found in open-wanderer Wanderer up to 0.19.x. It has been declared as critical. Impacted is the function event.fetch of the file /api/v1/trail/download of the component Download Handler. Such manipulation of the argument url leads to server-side request forgery.

This vulnerability is traded as CVE-2026-71495. The attack may be launched remotely. There is no exploit available.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More