EUVD-2026-31852Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.Permission(User.class, getUserId(), Device.class) and then immediately streams the uploaded body into mediaManager.createFileStream(...). Unlike the generic mutation path in BaseObjectResource.update and the explicit device mutation handler updateAccumulators, this route never invokes permissionsService.checkEdit(getUserId(), Device.class, false, false). The skipped guard is exactly where Traccar enforces readonly and deviceReadonly restrictions for non-admin users. An unauthorized user can replace a device’s stored image file under the server media directory. This allows modification of UI-visible device media and any downstream workflows that rely on the persisted image, despite other device update paths correctly rejecting the same identity. This vulnerability is fixed in 6.13.0.
AnalysisAI
Incorrect authorization in Traccar's DeviceResource.uploadImage endpoint allows authenticated low-privilege users to overwrite device image files on the server, bypassing readonly and deviceReadonly access restrictions that all other device mutation paths correctly enforce. Traccar versions prior to 6.13.0 are affected, and the root cause is a missing permissionsService.checkEdit call in the image upload route that is present everywhere else in the mutation surface. A proof-of-concept exists per SSVC data, though EPSS sits at 0.03% (9th percentile), indicating limited real-world exploitation activity to date. The vendor-released fix is available in version 6.13.0.
Technical ContextAI
Traccar is a Java-based open source GPS tracking platform (CPE: cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-863 (Incorrect Authorization), a class of flaws where a system checks the wrong permission or skips a required authorization gate. In this case, DeviceResource.uploadImage performs only an ownership check via Condition.Permission(User.class, getUserId(), Device.class), which confirms the requesting user can see the target device, but never calls permissionsService.checkEdit(getUserId(), Device.class, false, false). That checkEdit call is the sole enforcement point for Traccar's readonly and deviceReadonly user-level constraints. Contrast this with BaseObjectResource.update and the explicit updateAccumulators handler, both of which invoke checkEdit correctly. The result is an inconsistent authorization surface: a user blocked from editing device attributes via the standard API can still replace the device's stored media file by targeting the uploadImage route directly. The uploaded bytes are streamed directly to disk via mediaManager.createFileStream without the write-permission gate ever being applied.
RemediationAI
The primary fix is upgrading to Traccar 6.13.0, which resolves the issue by adding the missing permissionsService.checkEdit call to the DeviceResource.uploadImage route, bringing it in line with all other device mutation endpoints. The vendor advisory and release are documented at https://github.com/traccar/traccar/security/advisories/GHSA-33v4-5x2g-7mjm. If an immediate upgrade is not feasible, a targeted compensating control is to restrict network access to the Traccar API to only trusted administrator accounts at the reverse-proxy or firewall layer, preventing untrusted low-privilege users from reaching the uploadImage endpoint - though this trade-off limits the collaborative multi-user functionality of the platform. Alternatively, administrators can audit and remove readonly/deviceReadonly user accounts that do not require UI access to the device image feature until patching is complete. There is no known configuration flag to disable the image upload endpoint independently without modifying the application code.
Traccar is an open source GPS tracking system. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploi
Traccar versions 6.11.1 and later allow authenticated users to inject malicious JavaScript into other users' browsers by
Traccar GPS tracking system through version 6.11.1 allows authenticated users to hijack OAuth 2.0 authorization codes th
Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijack
Traccar GPS tracking system through version 6.11.1 allows authenticated users to conduct arbitrary file writes by settin
Use of Default Credentials vulnerability in Tananaev Solutions Traccar Server on Administrator Panel modules allows Auth
Traccar versions 6.11.1 through 6.13.0 fail to escape user-controlled device and computed attributes in CSV export funct
Traccar GPS Tracking System before version 4.9 has a LDAP injection vulnerability. Rated medium severity (CVSS 6.5), thi
Traccar is an open source GPS tracking system. Rated medium severity (CVSS 6.3), this vulnerability is no authentication
XML injection in Traccar 6.11.1 through 6.12.x allows authenticated users with low privileges to inject malicious XML in
Stored cross-site scripting (XSS) in Traccar 6.11.1 through 6.12.x allows low-privilege authenticated users to inject ma
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today