CVE-2026-44314
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Traccar before 6.13.0 has a vulnerability in DeviceResource.uploadImage that authorizes the device only via Condition.Permission, but does not check readonly/deviceReadonly for non-admins. An unauthorized user can replace a device's image in the server media directory.
Risk Assessment
An attacker can modify device images visible in the UI, potentially leading to data manipulation or fraud.
Recommendation
Update Traccar to version 6.13.0 or later.
Other vulnerabilities in Traccar
See all- CVE-2026-52852Medium
Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hierarchy and request a trips or stops report for a device in that hierarchy. GroupResource permits the parent cycle, while AttributeUtil.lookup follows group parents without cycle detection, a visited set, or a depth limit, causing the lookup to never terminate, pinning a Jetty worker at high CPU and potentially exhausting the web/API worker pool when requests are repeated.
- CVE-2026-52851High
In Traccar prior to 6.14.0, an authenticated non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. Validation checks only the first two keys, but removePermission() concatenates every map key into the SQL WHERE clause as column identifiers, enabling SQL injection and extraction of arbitrary database values, including administrator email, password hashes, and salts. The issue is fixed in 6.14.0.
Original NVD description (English source)
Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.Permission(User.class, getUserId(), Device.class) and then immediately streams the uploaded body into mediaManager.createFileStream(...). Unlike the generic mutation path in BaseObjectResource.update and the explicit device mutation handler updateAccumulators, this route never invokes permissionsService.checkEdit(getUserId(), Device.class, false, false). The skipped guard is exactly where Traccar enforces readonly and deviceReadonly restrictions for non-admin users. An unauthorized user can replace a device’s stored image file under the server media directory. This allows modification of UI-visible device media and any downstream workflows that rely on the persisted image, despite other device update paths correctly rejecting the same identity. This vulnerability is fixed in 6.13.0.