CVE-2025-61666: Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config File
Traccar is an open source GPS tracking system. Default installs of Traccar on Windows between versions 6.1- 6.8.1 and non default installs between versions 5.8 - 6.0 are vulnerable to unauthenticated local file inclusion attacks which can lead to leakage of passwords or any file on the file system including the Traccar configuration file. Versions 5.8 - 6.0 are only vulnerable if <entry key='web.override'>./override</entry> is set in the configuration file. Versions 6.1 - 6.8.1 are vulnerable by default as the web override is enabled by default. The vulnerable code is removed in version 6.9.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61666?
CVE-2025-61666 is classified as a high-severity vulnerability due to the potential for unauthenticated local file inclusion leading to sensitive data exposure.
How do I fix CVE-2025-61666?
To fix CVE-2025-61666, upgrade Traccar to version 6.8.2 or later, or implement appropriate security controls to limit access.
Who is affected by CVE-2025-61666?
CVE-2025-61666 affects default installations of Traccar on Windows from versions 6.1 to 6.8.1 and non-default installations from versions 5.8 to 6.0.
What risk does CVE-2025-61666 pose?
CVE-2025-61666 poses a risk of local file inclusion attacks that can result in the leakage of passwords and other sensitive files.
Is there a known exploit for CVE-2025-61666?
As of now, there is no publicly documented exploit for CVE-2025-61666, but its vulnerability nature indicates a high potential for exploitation.