CVE-2026-25648: Traccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File Upload
Versions of the Traccar open-source GPS tracking system starting with 6.11.1 contain an issue in which authenticated users can execute arbitrary JavaScript in the context of other users' browsers by uploading malicious SVG files as device images. The application accepts SVG file uploads without sanitization and serves them with the image/svg+xml Content-Type, allowing embedded JavaScript to execute when victims view the image. As of time of publication, it is unclear whether a fix is available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25648?
CVE-2026-25648 has a high severity rating due to its potential for arbitrary JavaScript execution.
How do I fix CVE-2026-25648?
To fix CVE-2026-25648, update the Traccar system to the latest version where the vulnerability has been patched.
Who is affected by CVE-2026-25648?
CVE-2026-25648 affects all users of Traccar versions 6.11.1 and above.
What are the consequences of CVE-2026-25648?
The consequences of CVE-2026-25648 include potential leakage of sensitive user data and session hijacking due to malicious JavaScript execution.
How does CVE-2026-25648 exploit the system?
CVE-2026-25648 exploits the system by allowing authenticated users to upload SVG files containing malicious JavaScript, which executes in the browser of other users.