CVE-2026-23521
Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can create or edit devices can set…
Published Feb 23, 2026 · updated Jun 17, 2026 · traccar traccar
Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can create or edit devices can set a device to an absolute path. When uploading a device image, Traccar uses that to build the filesystem path without enforcing that the resolved path stays under the media root. This allows writing files outside the media directory. As of time of publication, it is unclear whether a fix is available.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Feb 23, 2026 · NIST NVD
Detected
Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can create or edit devices can set a device to an absolute path. When uploading a device image, Traccar uses that to build the filesystem path without enforcing that the resolved path stays under the media root. This allows writing files outside the media directory.
Jun 17, 2026 · NIST NVD
Updated
Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can create or edit devices can set a device to an absolute path. When uploading a device image, Traccar uses that to build the filesystem path without enforcing that the resolved path stays under the media root. This allows writing files outside the media directory.
Affected
- cpe traccar/traccarversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-23521
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-23521
Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can create or edit devices can set a device to an absolute path. When uploading a device image, Traccar uses that to build th
nvd.nist.gov