CVE-2026-23521: Traccar vulnerable to Path Traversal and External Control of File Name or Path
Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can create or edit devices can set a device uniqueId to an absolute path. When uploading a device image, Traccar uses that uniqueId to build the filesystem path without enforcing that the resolved path stays under the media root. This allows writing files outside the media directory. As of time of publication, it is unclear whether a fix is available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23521?
CVE-2026-23521 is classified as a high-severity vulnerability due to the potential for exploitation by authenticated users.
How do I fix CVE-2026-23521?
To remediate CVE-2026-23521, upgrade to Traccar version 6.12 or later, where this issue has been addressed.
Who is affected by CVE-2026-23521?
CVE-2026-23521 affects all users of Traccar versions up to and including 6.11.1 who can create or edit devices.
What is the impact of CVE-2026-23521?
The impact of CVE-2026-23521 includes unauthorized access to the filesystem, potentially allowing sensitive information disclosure or system compromise.
Can CVE-2026-23521 be exploited remotely?
CVE-2026-23521 requires authentication, meaning it cannot be exploited remotely without valid user credentials.