Vulnerability · Published Feb 23, 2026 · Assigned by GitHub_M
CVE-2026-25648Traccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File Upload
High 8.7
In plain English
A high-severity cross-site scripting in traccar from traccar. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Official description
Versions of the Traccar open-source GPS tracking system starting with 6.11.1 contain an issue in which authenticated users can execute arbitrary JavaScript in the context of other users' browsers by uploading malicious SVG files as device images. The application accepts SVG file uploads without sanitization and serves them with the `image/svg+xml` Content-Type, allowing embedded JavaScript to execute when victims view the image. As of time of publication, it is unclear whether a fix is available.
Affected products (as reported)
Weakness: CWE-79, CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
References
- https://github.com/traccar/traccar/security/advisories/GHSA-mc2g-mjqh-8x78 x_refsource_CONFIRM