CVE-2026-25648
📋 TL;DR
Authenticated users in Traccar GPS tracking system can upload malicious SVG files containing JavaScript, which executes in other users' browsers when they view the image. This cross-site scripting (XSS) vulnerability affects all users of Traccar versions 6.11.1 and later. Attackers can steal session cookies, perform actions as victims, or redirect to malicious sites.
💻 Affected Systems
- Traccar GPS tracking system
📦 What is this software?
Traccar by Traccar
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative access, compromise all user accounts, steal sensitive location data, and pivot to internal networks.
Likely Case
Session hijacking, account takeover, data theft, and malicious actions performed as authenticated users.
If Mitigated
Limited impact with proper input validation, content security policies, and file upload restrictions in place.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://github.com/traccar/traccar/security/advisories/GHSA-mc2g-mjqh-8x78
Restart Required: Yes
Instructions:
Monitor the GitHub advisory for patch availability. When available, update to the patched version and restart the Traccar service.
🔧 Temporary Workarounds
Disable SVG uploads
allConfigure Traccar to reject SVG file uploads entirely.
Modify Traccar configuration to restrict allowed file types to non-SVG formats
Implement Content Security Policy
allAdd CSP headers to prevent inline script execution from SVG files.
Add 'Content-Security-Policy: script-src 'self'' header to web server configuration
🧯 If You Can't Patch
- Restrict SVG file uploads to trusted administrators only
- Implement web application firewall rules to block malicious SVG content
🔍 How to Verify
Check if Vulnerable:
Check if running Traccar version 6.11.1 or later and verify SVG upload functionality is enabled.Check Version:
Check Traccar web interface or configuration files for version informationVerify Fix Applied:
After applying workarounds, test SVG upload with embedded JavaScript to confirm it no longer executes.📡 Detection & Monitoring
Log Indicators:
- Unusual SVG file uploads
- Multiple failed login attempts followed by SVG uploads
Network Indicators:
- HTTP requests for SVG files with suspicious parameters
- Outbound connections to unknown domains after SVG access
SIEM Query:
source="traccar" AND (file_extension="svg" OR content_type="image/svg+xml")