CVE-2026-23521: Traccar Path Traversal Vulnerability

CVE-2026-23521 Overview

CVE-2026-23521 is a path traversal vulnerability affecting the Traccar open-source GPS tracking system. Versions up to and including 6.11.1 contain an issue where authenticated users with device creation or editing privileges can set a device uniqueId to an absolute path. When uploading a device image, Traccar uses that uniqueId to build the filesystem path without enforcing that the resolved path stays under the media root directory. This vulnerability allows attackers to write arbitrary files outside the intended media directory.

Critical Impact

Authenticated attackers can write files outside the media directory, potentially overwriting critical system files or application configurations, leading to arbitrary code execution or denial of service.

Affected Products

• Traccar GPS Tracking System versions up to and including 6.11.1

Discovery Timeline

• 2026-02-23 - CVE-2026-23521 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-23521

Vulnerability Analysis

This path traversal vulnerability (CWE-22) exists in Traccar's device image upload functionality. The application fails to properly sanitize or validate the uniqueId field when constructing filesystem paths for uploaded device images. An authenticated user with permissions to create or edit devices can manipulate the uniqueId parameter to include directory traversal sequences or absolute paths, enabling them to write files to arbitrary locations on the server filesystem.

The vulnerability requires network access and low-privilege authentication to exploit. While there is no direct impact on data confidentiality, the ability to write arbitrary files poses a significant integrity risk. Attackers could potentially overwrite application configuration files, inject malicious scripts, or modify system binaries depending on the Traccar service's filesystem permissions.

Root Cause

The root cause of this vulnerability is improper input validation in the device image upload handler. The application constructs the destination file path by directly concatenating the user-supplied uniqueId value without verifying that the resulting path remains within the designated media directory. This lack of path canonicalization and boundary checking allows directory traversal attacks.

Attack Vector

The attack is network-based and requires an authenticated user account with device management privileges. An attacker would:

1. Create or edit a device in the Traccar system
2. Set the uniqueId field to a path traversal sequence (e.g., /etc/cron.d/malicious or ../../../var/www/backdoor.php)
3. Upload an image file through the device image upload feature
4. The malicious content is written to the attacker-controlled path outside the media directory

The vulnerability does not require user interaction beyond the attacker's own actions. The exact exploitability depends on the filesystem permissions of the Traccar process and the target system's configuration.

Detection Methods for CVE-2026-23521

Indicators of Compromise

• Unusual device uniqueId values containing path traversal sequences such as ../, ..\\, or absolute paths starting with /
• New or modified files appearing outside the Traccar media directory that correspond to recent device image uploads
• Unexpected files in sensitive directories like /etc/, /var/www/, or the Traccar installation directory
• Anomalous file write operations by the Traccar service process to locations outside its normal working directories

Detection Strategies

• Monitor Traccar application logs for device creation/modification events with suspicious uniqueId patterns
• Implement file integrity monitoring (FIM) on critical system directories and the Traccar installation path
• Deploy web application firewall (WAF) rules to detect path traversal patterns in API requests to the device management endpoints
• Review database records for device entries with uniqueId values containing path traversal characters

Monitoring Recommendations

• Enable detailed audit logging for all device management operations in Traccar
• Configure alerts for file system write operations by the Traccar process outside the designated media directory
• Implement regular scans for newly created files in sensitive system directories
• Monitor network traffic for suspicious patterns in device image upload requests

How to Mitigate CVE-2026-23521

Immediate Actions Required

• Review all existing device records for suspicious uniqueId values containing path traversal sequences
• Restrict device creation and editing privileges to trusted administrators only
• Implement network segmentation to limit access to the Traccar management interface
• Consider temporarily disabling the device image upload feature if not critical to operations
• Run Traccar with minimal filesystem permissions to limit the impact of potential exploitation

Patch Information

As of the publication date, it is unclear whether a fix is available from the Traccar project. Organizations should monitor the Traccar GitHub Security Advisory for updates on patches and remediation guidance.

Workarounds

• Implement input validation at the application or reverse proxy level to block uniqueId values containing path traversal characters (../, ..\\) or absolute paths
• Use a web application firewall to filter requests containing path traversal patterns in device-related API endpoints
• Run Traccar in a containerized environment with read-only filesystem mounts for sensitive directories
• Configure filesystem permissions to prevent the Traccar service account from writing to directories outside its designated data paths
• Implement mandatory access controls (SELinux, AppArmor) to confine Traccar's file write operations

# Example: Restrict Traccar service filesystem permissions
# Create a dedicated service account with limited write access
useradd -r -s /sbin/nologin traccar-service

# Set ownership and permissions on media directory only
chown -R traccar-service:traccar-service /opt/traccar/media
chmod 755 /opt/traccar/media

# Make other directories read-only for the service
chmod -R a-w /opt/traccar/conf
chmod -R a-w /opt/traccar/web