Quick answers
- Is CVE-2026-44314 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-44314 being exploited in the wild.
- How severe is CVE-2026-44314?
- Informational severity, with a CVSS score of 5.3, published 26 May 2026.
- Which products and versions are affected?
- Traccar Prior to 6.13.0.
- Is there a fix for CVE-2026-44314?
- A patch was published on 2026-05-26: Fix released in version 6.13.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-44314 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-44314?
- Check whether you run Traccar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An incorrect authorization vulnerability exists in the `DeviceResource.uploadImage` endpoint of Traccar. The application validates device permissions using `Condition.Permission` but fails to invoke `permissionsService.checkEdit`, which is the standard mechanism for enforcing `readonly` and `deviceReadonly` restrictions. Consequently, an authenticated user—including those using temporary shared-device tokens intended for read-only access—can trigger a file write to the server's media directory via `mediaManager.createFileStream`. This allows unauthorized modification of device-associated image files. The issue is fixed in version 6.13.0 by ensuring the edit permission check is performed before the file stream is created.
Affected products
- Traccar Traccar Prior to 6.13.0
Timeline
- 2026-05-05: advisory: GitHub Security Advisory published
- 2026-05-26: disclosed: CVE published to NVD
- 2026-05-26: patched: Fix released in version 6.13.0