PT-2026-21559 · Traccar · Traccar

Djvirus9 · Published 2026-02-23 · Updated 2026-02-28 · CVE-2026-25648

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Traccar versions 6.11.1 and later

Description Traccar, an open-source GPS tracking system, is affected by a stored cross-site scripting (XSS) issue. Authenticated users can upload malicious SVG files as device images. The application does not sanitize these files and serves them with the image/svg+xml Content-Type, allowing embedded JavaScript to execute in the context of other users' browsers. The vulnerability allows for the execution of arbitrary JavaScript. The API Endpoint for file uploads is implicated in this issue. The vulnerable parameter is the SVG file itself, specifically the embedded JavaScript within the SVG file.

Recommendations Traccar versions 6.11.1 and later: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Unrestricted File Upload

Weakness Enumeration

CWE-79

CWE-434

Related Identifiers

CVE-2026-25648

GHSA-MC2G-MJQH-8X78

Affected Products

Traccar

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25648.json · Exploit
• https://github.com/traccar/traccar/security/advisories/GHSA-mc2g-mjqh-8x78 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25648 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25648 · Vendor Advisory
• https://twitter.com/cracbot/status/2027338106953924694 · Twitter Post
• https://twitter.com/CVEnew/status/2026265021768937769 · Twitter Post
• https://twitter.com/CveTodo/status/2026046957228068873 · Twitter Post
• https://twitter.com/pulsepatchio/status/2026310981056360864 · Twitter Post
• https://twitter.com/TheHackerWire/status/2026044704333402519 · Twitter Post
• https://twitter.com/CveFindCom/status/2026049812244611492 · Twitter Post
• https://twitter.com/cracbot/status/2027700406764396962 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2026061692614922658 · Twitter Post
• https://t.me/cveNotify/153320 · Telegram Post
• https://t.me/CVEtracker/45518 · Telegram Post