Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can create or edit devices can set a device `uniqueId` to an absolute path. When uploading a device image, Traccar uses that `uniqueId` to build the filesystem path without enforcing that the resolved path stays under the media root. This allows writing files outside the media directory. As of time of publication, it is unclear whether a fix is available.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-23521 Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can create or edit devices can se… https://www.cve.org/CVERecord?id=CVE-2026-23521
Post summary
The text announces a CVE for Traccar GPS tracking system affecting authenticated users up to version 6.11.1, but provides no further technical or mitigation details.
CVE-2026-23521 Traccar GPS Tracking System Authenticated Path Traversal Vulnerab... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-23521 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
A new authenticated path traversal vulnerability (CVE-2026-23521) in Traccar GPS Tracking System has been disclosed, with details available via the provided link.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | traccar | traccar | - | - | - |