CVE-2026-23521

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23521", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-13T18:22:43.980Z", "datePublished": "2026-02-23T20:57:31.195Z", "dateUpdated": "2026-02-25T15:15:06.269Z"}, "containers": {"cna": {"title": "Traccar vulnerable to Path Traversal and External Control of File Name or Path", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-73", "lang": "en", "description": "CWE-73: External Control of File Name or Path", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/traccar/traccar/security/advisories/GHSA-rc28-cvfc-chqr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/traccar/traccar/security/advisories/GHSA-rc28-cvfc-chqr"}], "affected": [{"vendor": "traccar", "product": "traccar", "versions": [{"version": "<= 6.11.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-23T20:57:31.195Z"}, "descriptions": [{"lang": "en", "value": "Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can create or edit devices can set a device `uniqueId` to an absolute path. When uploading a device image, Traccar uses that `uniqueId` to build the filesystem path without enforcing that the resolved path stays under the media root. This allows writing files outside the media directory. As of time of publication, it is unclear whether a fix is available."}], "source": {"advisory": "GHSA-rc28-cvfc-chqr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T15:14:39.301719Z", "id": "CVE-2026-23521", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T15:15:06.269Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23521", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-25T15:14:39.301719Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T15:14:57.822Z"}}], "cna": {"title": "Traccar vulnerable to Path Traversal and External Control of File Name or Path", "source": {"advisory": "GHSA-rc28-cvfc-chqr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "traccar", "product": "traccar", "versions": [{"status": "affected", "version": "<= 6.11.1"}]}], "references": [{"url": "https://github.com/traccar/traccar/security/advisories/GHSA-rc28-cvfc-chqr", "name": "https://github.com/traccar/traccar/security/advisories/GHSA-rc28-cvfc-chqr", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can create or edit devices can set a device `uniqueId` to an absolute path. When uploading a device image, Traccar uses that `uniqueId` to build the filesystem path without enforcing that the resolved path stays under the media root. This allows writing files outside the media directory. As of time of publication, it is unclear whether a fix is available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73: External Control of File Name or Path"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-23T20:57:31.195Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23521", "state": "PUBLISHED", "dateUpdated": "2026-02-25T15:15:06.269Z", "dateReserved": "2026-01-13T18:22:43.980Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-23T20:57:31.195Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "traccar", "vendor": "traccar", "versions": [{"status": "affected", "version": "<= 6.11.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*", "matchCriteriaId": "76FAA1A2-2E75-4EAC-A7FA-BD790B7986A6", "versionEndIncluding": "6.11.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can create or edit devices can set a device `uniqueId` to an absolute path. When uploading a device image, Traccar uses that `uniqueId` to build the filesystem path without enforcing that the resolved path stays under the media root. This allows writing files outside the media directory. As of time of publication, it is unclear whether a fix is available."}, {"lang": "es", "value": "Las versiones del sistema de seguimiento GPS de c\u00f3digo abierto Traccar hasta la 6.11.1 inclusive contienen un problema en el que los usuarios autenticados que pueden crear o editar dispositivos pueden establecer el 'uniqueId' de un dispositivo a una ruta absoluta. Al cargar una imagen de dispositivo, Traccar utiliza ese 'uniqueId' para construir la ruta del sistema de archivos sin asegurar que la ruta resuelta permanezca bajo la ra\u00edz de medios. Esto permite escribir archivos fuera del directorio de medios. Al momento de la publicaci\u00f3n, no est\u00e1 claro si hay una soluci\u00f3n disponible."}], "id": "CVE-2026-23521", "lastModified": "2026-06-17T10:21:43.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23521", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T15:14:39.301719Z", "version": "2.0.3"}}]}, "published": "2026-02-23T21:19:09.990", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/traccar/traccar/security/advisories/GHSA-rc28-cvfc-chqr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-73"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.11.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "traccar", "source": "cna", "vendor": "traccar"}, "product": "traccar", "vendor": "traccar"}], "analysis": {"en": {"generated_at": "2026-04-17T16:14:09.247019+00:00", "value": {"mitigation_remediation": ["Apply the latest Traccar update once the vendor releases a fix for the path traversal issue or upgrade to a fixed version. ", "Restrict device creation and editing rights to administrative users only, removing the ability for regular accounts to set absolute uniqueIds. ", "Configure the media root directory and its file system permissions so that Traccar can write only within that folder and prevent writes to the rest of the server. ", "If no vendor patch is available, modify the device image upload handling to reject or sanitize absolute paths supplied in the uniqueId before constructing the file path."], "summary": {"action": "Patch Update", "impact": "Arbitrary File Write"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Traccar open\u2011source GPS tracking system, versions up to and including 6.11.1. No other vendor or product is listed, and no specific patch version has been released at the time of publication.", "description_and_impact": "A flaw in Traccar allows authenticated users who can create or edit devices to set the device uniqueId to an absolute path. When an image for the device is uploaded, the application uses this uniqueId to build a filesystem path without ensuring that the resulting path remains under the configured media root. This results in the ability to write files outside the intended media directory, potentially overwriting critical system files or placing malicious files in executable locations.", "risk_and_exploitability": "With a CVSS score of 6.5 the severity is moderate, and the EPSS score indicates a very low current exploitation probability (<1%). The flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated Traccar account with device creation or editing rights; the attacker then crafts a uniqueId containing an absolute path and uploads an image, causing the server to write the payload outside the media root."}}}}, "created": "2026-02-24T09:54:50.817124+00:00", "updated": "2026-04-17T16:15:22.653930+00:00", "vendors": ["traccar", "traccar$PRODUCT$traccar"]}