PT-2025-40429 · Traccar · Traccar

Eddiez9 + 1 · Published 2025-10-02 · Updated 2025-12-03 · CVE-2025-61666

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Traccar versions 5.8 through 6.0 Traccar versions 6.1 through 6.8.1

Description Traccar, an open source GPS tracking system, has a flaw that allows for unauthenticated local file inclusion attacks. This can result in the disclosure of passwords or any file on the file system, including the Traccar configuration file. Versions 5.8 through 6.0 are susceptible only if the configuration file includes <entry key='web.override'>./override</entry>. Versions 6.1 through 6.8.1 are vulnerable by default due to the web override being enabled.

Recommendations Update to version 6.9.0 or later. For versions 5.8 through 6.0, ensure the <entry key='web.override'>./override</entry> setting is removed from the configuration file.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-61666

GHSA-HPRC-RPH8-FJ87

Affected Products

Traccar

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61666.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-61666 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61666 · Vendor Advisory
• https://github.com/traccar/traccar/security/advisories/GHSA-hprc-rph8-fj87 · Note
• https://github.com/traccar/traccar/blob/v6.8.1/src/main/java/org/traccar/web/DefaultOverrideServlet.java · Note
• https://projectblack.io/blog/jetty-addpath-lfi · Note
• https://twitter.com/leak_ix/status/1996127268427403715 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/1977449221453127767 · Twitter Post
• https://t.me/CVEtracker/33985 · Telegram Post
• https://twitter.com/CVEnew/status/1973862330623533420 · Twitter Post
• https://leakix.net/search?q=%2Bplugin%3ATraccarPlugin&scope=leak · Reddit Post