Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type

published 2024-04-10 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-22183

cvss: 8.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 54.4%; EPSS 54.4% chance of exploitation in 30 days, percentile 99%
public exploits: 2; Metasploit, plus a Nuclei check

Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this vulnerability to upload files with the prefix `device.` under any folder. Attackers can use this vulnerability for phishing, cross-site scripting attacks, and potentially execute arbitrary commands on the server. Version 6.0 contains a patch for the issue.

Patch / fix

fixed in 1 links 1

traccar traccar 6.0

github.com/traccar/traccar@b099b29 commit

Timeline

2024-04-10 Published
2024-08-23 First public exploit (Metasploit exploit/linux/http/traccar_rce_upload)

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-04-10)

Exploit prediction

54.41% chance of exploitation in the next 30 days, higher than 99% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/linux/http/paloalto_expedition_rce Palo Alto Expedition Remote Code Execution (CVE-2024-5910 and CVE-2024-9464) metasploit exploit, excellent rank, 2024-10-09
Metasploit exploit/linux/http/traccar_rce_upload Traccar v5 Remote Code Execution (CVE-2024-31214 and CVE-2024-24809) metasploit exploit, excellent rank, 2024-08-23
Nuclei template Traccar - Unrestricted File Upload nuclei detection template

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

Affected products

traccar traccar

Classification

Weakness

CWE-27 Path Traversal: 'dir/../../filename'
CWE-434 Unrestricted Upload of File with Dangerous Type

References

Sources

CVE List CVE-2024-24809
NVD CVE-2024-24809

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary