PT-2026-21559 · Traccar · Traccar

Djvirus9 · Publicado 2026-02-23 · Atualizado 2026-02-28 · CVE-2026-25648

Positive Technologies (AI Summary)

CVSS v3.1

8.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Traccar versions 6.11.1 and later

Description Traccar, an open-source GPS tracking system, is affected by a stored cross-site scripting (XSS) issue. Authenticated users can upload malicious SVG files as device images. The application does not sanitize these files and serves them with the image/svg+xml Content-Type, allowing embedded JavaScript to execute in the context of other users' browsers. The vulnerability allows for the execution of arbitrary JavaScript. The API Endpoint for file uploads is implicated in this issue. The vulnerable parameter is the SVG file itself, specifically the embedded JavaScript within the SVG file.

Recommendations Traccar versions 6.11.1 and later: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Unrestricted File Upload

Enumeração de Fraquezas

CWE-79

CWE-434

Identificadores relacionados

CVE-2026-25648

GHSA-MC2G-MJQH-8X78

Produtos afetados

Traccar

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25648.json · Exploit
• https://github.com/traccar/traccar/security/advisories/GHSA-mc2g-mjqh-8x78 · Aviso do Fabricante
• https://twitter.com/cracbot/status/2027338106953924694 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2026265021768937769 · Publicação no Twitter
• https://twitter.com/CveTodo/status/2026046957228068873 · Publicação no Twitter
• https://twitter.com/pulsepatchio/status/2026310981056360864 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2026044704333402519 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-25648 · Nota de Segurança
• https://twitter.com/CveFindCom/status/2026049812244611492 · Publicação no Twitter
• https://twitter.com/cracbot/status/2027700406764396962 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2026061692614922658 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-25648 · Aviso do Fabricante
• https://t.me/cveNotify/153320 · Publicação no Telegram
• https://t.me/CVEtracker/45518 · Publicação no Telegram