Read the docs
TI-2024-16326 Aliases CVE-2024-24809

Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type

Priority HIGH 69CWE-27Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this vulnerability to upload files with the prefix `device.` under any folder. Attackers can use this vulnerability for phishing, cross-site scripting attacks, and potentially execute arbitrary commands on the server. Version 6.0 contains a patch for the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.54413 99th percentileScored 2026-11-07
Fix Fixed traccar (traccar): 6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
traccartraccarbefore 6.06.0Patch availableCNA
  • traccar Vendortraccar Affected before 6.0 Fixed in 6.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*——traccar
  • cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:* Versions — — ·traccar

Remediation

  • Fix · CNA traccar (traccar) Fixed in 6.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-24809
  2. 2026-10-14 EPSS moved to the 99th percentile and above

References

Other 2

  • TI-2025-38099 Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config File CVSS 4.0HIGH 8.7
  • TI-2024-20591 Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution CVSS 3.1CRITICAL 9.7
  • TI-2026-20749 Traccar Vulnerable to Authorization Code Theft via Open Redirect in OIDC Provider Endpoints CVSS 3.1HIGH 8.7
  • TI-2026-20748 Traccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File Upload CVSS 3.1HIGH 8.7
  • TI-2026-70716 Weak password recovery in Traccar lets reset tokens act as sessions CVSS 4.0HIGH 7.6
  • TI-2026-37956 Traccar: Authenticated Blind SQL Injection in DELETE /api/permissions CVSS 3.1HIGH 7.1
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences