CVE-2024-24809: high-severity vulnerability in traccar
Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
90Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 8.5epss 54%
from disclosure to weapon146 days
Published on NVDApr 10
1st PoC+146d
metasploit+135d
VulnCheck+942d
Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this vulnerability to upload files with the prefix `device.` under any folder. Attackers can use this vulnerability for phishing, cross-site scripting attacks, and potentially execute arbitrary commands on the server. Version 6.0 contains a patch for the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
Affected products
traccar · traccarpublic PoCs found — 1
vulncheckvulncheck.com/xdb/47c12ef117f5unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — traccar
In the same product, most dangerous first.
CVE-2024-31214CRITICALTraccar's unrestricted file upload vulnerability in device image upload could lead to remote code executionEPSS 17.6%CVE-2025-61666HIGHTraccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config FileEPSS 1.3%CVE-2026-104203HIGHTraccar: Authentication bypass via path parameters exposes protected device mediaEPSS 0.8%CVE-2023-50729HIGHAn unrestricted file upload vulnerability in traccar leads to RCEEPSS 0.6%CVE-2025-68930HIGHTraccar Missing Origin Validation in WebSocketsEPSS 0.6%CVE-2026-52852MEDIUMTraccar: Uncontrolled Infinite Loop DoS via Group Parent CycleEPSS 0.5%