Executive brief
Traccar is an open-source GPS tracking platform used to manage and monitor vehicle or asset locations. A security flaw in the system allows users who should only have "read-only" access to bypass these restrictions and upload or replace device images. This could allow an unauthorized person to change the visual representation of a device in the management interface or interfere with workflows that rely on these images.
Technical details
An incorrect authorization vulnerability exists in the `DeviceResource.uploadImage` endpoint of Traccar. The application validates device permissions using `Condition.Permission` but fails to invoke `permissionsService.checkEdit`, which is the standard mechanism for enforcing `readonly` and `deviceReadonly` restrictions. Consequently, an authenticated user—including those using temporary shared-device tokens intended for read-only access—can trigger a file write to the server's media directory via `mediaManager.createFileStream`. This allows unauthorized modification of device-associated image files. The issue is fixed in version 6.13.0 by ensuring the edit permission check is performed before the file stream is created.
Affected products
- Traccar Traccar Prior to 6.13.0
Timeline
- 2026-05-05: advisory: GitHub Security Advisory published
- 2026-05-26: disclosed: CVE published to NVD
- 2026-05-26: patched: Fix released in version 6.13.0