CVE-2026-23521
Path Traversal in Traccar Device Image Upload Allows File Write
Publication date: 2026-02-23
Last updated on: 2026-02-26
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| traccar | traccar | to 6.11.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
| CWE-73 | The product allows user input to control or influence paths or file names that are used in filesystem operations. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'This vulnerability exists in versions of the Traccar GPS tracking system up to 6.11.1. Authenticated users who have permission to create or edit devices can set a device\'s uniqueId to an absolute filesystem path. When uploading a device image, Traccar uses this uniqueId to build the file path without ensuring the path stays within the intended media directory. Because the system only blocks certain path traversal sequences like ".." but does not prevent absolute paths, an attacker can cause files to be written outside the media directory.'}, {'type': 'paragraph', 'content': "This improper path validation allows an attacker to write files anywhere on the server's filesystem where the server process has write permissions, potentially leading to filesystem manipulation or overwriting critical files."}] [1]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'The vulnerability can allow an attacker with device creation or editing privileges to write arbitrary files outside the designated media directory. This can lead to unauthorized modification or tampering of files on the server.'}, {'type': 'paragraph', 'content': "The impact depends on the server's filesystem permissions but is generally considered high risk because it can compromise the integrity of the system by overwriting or injecting malicious files."}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by checking if any devices in the Traccar system have a uniqueId set to an absolute filesystem path. Since the issue involves authenticated users setting the uniqueId to an absolute path, inspecting device configurations for absolute paths can help identify potential exploitation.'}, {'type': 'paragraph', 'content': "A practical approach is to query the Traccar API or database for devices where the uniqueId starts with root directory indicators such as '/' on Linux/macOS or a drive letter like 'C:\\' on Windows."}, {'type': 'paragraph', 'content': 'Example commands to detect such uniqueIds might include:'}, {'type': 'list_item', 'content': "Using SQL (if device data is stored in a database): SELECT * FROM devices WHERE uniqueId LIKE '/%' OR uniqueId LIKE 'C:\\\\%';"}, {'type': 'list_item', 'content': 'Using API calls to list devices and filter uniqueIds starting with absolute path patterns.'}, {'type': 'list_item', 'content': 'On the filesystem, monitoring unexpected file writes outside the media directory (e.g., in /tmp or C:\\temp) can also indicate exploitation.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting the ability to create or edit devices and upload device images to only fully trusted users, as the vulnerability requires authenticated users with these permissions.
Additionally, monitor and audit device uniqueId values to ensure none are set to absolute paths.
If possible, apply input validation to reject absolute paths or path separators in uniqueId values before they are accepted by the system.
Since a fix may not yet be available, consider implementing or requesting a patch that normalizes and enforces that the resolved file path remains within the media root directory, as described in the advisory.
Finally, monitor filesystem locations outside the media directory for unexpected files that could indicate exploitation.