CVE-2024-24809highexplotación observadaCWE-27CWE-434

CVE-2024-24809: fallo de gravedad alta en traccar

Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear traccar

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

90Vexday Risk Score

Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.

ssvc Actcvss 8.5epss 54%
de la publicación al arma146 días
Publicada en NVD10 abr
1ª PoC+146d
metasploit+135d
VulnCheck+942d
Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this vulnerability to upload files with the prefix `device.` under any folder. Attackers can use this vulnerability for phishing, cross-site scripting attacks, and potentially execute arbitrary commands on the server. Version 6.0 contains a patch for the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
Productos afectados
traccar · traccar
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — traccar

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-31214CRITICALTraccar's unrestricted file upload vulnerability in device image upload could lead to remote code executionEPSS 17.6%CVE-2025-61666HIGHTraccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config FileEPSS 1.3%CVE-2026-104203HIGHTraccar: Authentication bypass via path parameters exposes protected device mediaEPSS 0.8%CVE-2023-50729HIGHAn unrestricted file upload vulnerability in traccar leads to RCEEPSS 0.6%CVE-2025-68930HIGHTraccar Missing Origin Validation in WebSocketsEPSS 0.6%CVE-2026-52852MEDIUMTraccar: Uncontrolled Infinite Loop DoS via Group Parent CycleEPSS 0.5%