PT-2025-40429 · Traccar · Traccar

Eddiez9 + 1 · Publicado 2025-10-02 · Atualizado 2025-12-03 · CVE-2025-61666

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Traccar versions 5.8 through 6.0 Traccar versions 6.1 through 6.8.1

Description Traccar, an open source GPS tracking system, has a flaw that allows for unauthenticated local file inclusion attacks. This can result in the disclosure of passwords or any file on the file system, including the Traccar configuration file. Versions 5.8 through 6.0 are susceptible only if the configuration file includes <entry key='web.override'>./override</entry>. Versions 6.1 through 6.8.1 are vulnerable by default due to the web override being enabled.

Recommendations Update to version 6.9.0 or later. For versions 5.8 through 6.0, ensure the <entry key='web.override'>./override</entry> setting is removed from the configuration file.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2025-61666

GHSA-HPRC-RPH8-FJ87

Produtos afetados

Traccar

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61666.json · Exploit
• https://github.com/traccar/traccar/security/advisories/GHSA-hprc-rph8-fj87 · Nota
• https://github.com/traccar/traccar/blob/v6.8.1/src/main/java/org/traccar/web/DefaultOverrideServlet.java · Nota
• https://projectblack.io/blog/jetty-addpath-lfi · Nota
• https://twitter.com/leak_ix/status/1996127268427403715 · Publicação no Twitter
• https://twitter.com/pdnuclei_bot/status/1977449221453127767 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-61666 · Nota de Segurança
• https://t.me/CVEtracker/33985 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1973862330623533420 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-61666 · Aviso do Fabricante
• https://leakix.net/search?q=%2Bplugin%3ATraccarPlugin&scope=leak · Publicação no Reddit