What is the CVSS score of CVE-2026-25648?

CVE-2026-25648 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Traccar are affected by CVE-2026-25648?

Authenticated users of Traccar GPS tracking systems (versions 6.11.1+) can inject malicious code that executes in other users' browsers, potentially leading to session hijacking, credential theft, or…

Is there a public PoC exploit available for CVE-2026-25648?

Yes, a public proof-of-concept exploit is available for CVE-2026-25648. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25648?

Within 24 hours: Identify all Traccar instances in use and document affected versions; restrict file upload capabilities to trusted administrators only. Within 7 days: Implement input validation and content-type restrictions on SVG uploads; conduct access review of who has device image upload permissions. Within 30 days: Evaluate alternative GPS tracking solutions; plan migration away from affected Traccar versions or implement strict network segmentation for Traccar environments until vendor patch is released.

Traccar CVE-2026-25648

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-23 security-advisories@github.com

File Upload RCE XSS Traccar

8.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 26, 2026 - 16:25 vuln.today

Public exploit code

CVE Published

Feb 23, 2026 - 21:19 nvd

HIGH 8.7

DescriptionGitHub Advisory

Versions of the Traccar open-source GPS tracking system starting with 6.11.1 contain an issue in which authenticated users can execute arbitrary JavaScript in the context of other users' browsers by uploading malicious SVG files as device images. The application accepts SVG file uploads without sanitization and serves them with the image/svg+xml Content-Type, allowing embedded JavaScript to execute when victims view the image. As of time of publication, it is unclear whether a fix is available.

AnalysisAI

Traccar versions 6.11.1 and later allow authenticated users to inject malicious JavaScript into other users' browsers by uploading unsanitized SVG files as device images, exploiting improper Content-Type handling. Public exploit code exists for this reflected cross-site scripting vulnerability, which could enable session hijacking or credential theft with no patch currently available.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Traccar. Versions of the Traccar open-source GPS tracking system starting with 6.11.1 contain an issue in which authenticated users can execute arbitrary JavaScript in the context of other users' browsers by uploading malicious SVG files as device images. The application accepts SVG file uploads without sanitization and serves them with the image/svg+xml Content-Type, allowing embedded JavaScript to execute when victims view the image. As of time of publication, it is unclear whether a fix is available

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.