Vulnerability · Published Feb 23, 2026 · Assigned by GitHub_M

CVE-2026-23521Traccar vulnerable to Path Traversal and External Control of File Name or Path

Medium 6.5

In plain English

A medium-severity path traversal in traccar from traccar. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 68.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can create or edit devices can set a device `uniqueId` to an absolute path. When uploading a device image, Traccar uses that `uniqueId` to build the filesystem path without enforcing that the resolved path stays under the media root. This allows writing files outside the media directory. As of time of publication, it is unclear whether a fix is available.

Affected products (as reported)

Vendor	Product	Versions
traccar	traccar	<= 6.11.1

Weakness: CWE-22, CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/traccar/traccar/security/advisories/GHSA-rc28-cvfc-chqr x_refsource_CONFIRM