H3-2024-0030
Traccar Device Image Upload Remote Code Execution Vulnerability
| Category | VULNERABILITY |
| Base Score | 9.0 |
Description
Traccar 5.1 to 5.12 is vulnerable to path traversal in the device image upload API of the web server component. This allows Traccar users to upload files with certain restricted names anywhere on the target file system.
Impact
Remote attackers can execute arbitrary commands on the server. On Linux hosts, where Traccar typically runs as root, this can lead to full system compromise. If user self-registration is enabled, which is the default setting in Traccar 5, this vulnerability allows anyone to log in and compromise the Traccar server. Depending on the target host, user login or a host reboot may be required to trigger remote code execution.