CVE-2026-44314 Traccar: Missing edit authorization on device image upload allows read-only users to write files
Read-only users can upload and replace device images due to missing edit authorization checks in the image upload endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-44314?
CVE-2026-44314 is a medium-severity missing authorization vulnerability in traccar, published on 26 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.Permission(User.class, getUserId(), Device.class) and then immediately streams the uploaded body into mediaManager.createFileStream(...). Unlike the generic mutation path in BaseObjectResource.update and the explicit device mutation handler updateAccumulators, this route never invokes permissionsService.checkEdit(getUserId(), Device.class, false, false). The skipped guard is exactly where Traccar enforces readonly and deviceReadonly restrictions for non-admin users. An unauthorized user can replace a device’s stored image file under the server media directory. This allows modification of UI-visible device media and any downstream workflows that rely on the persisted image, despite other device update paths correctly rejecting the same identity. This vulnerability is fixed in 6.13.0.
Weakness: CWE-863
Which versions are affected by CVE-2026-44314?
It affects 1 product.
Products include Traccar Traccar.
How do I fix CVE-2026-44314?
No fix has been published for CVE-2026-44314 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-44314 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44314 exists.
Other vulnerabilities in traccar
- CVE-2024-31214 Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution
- CVE-2024-7746 Use of default credentials at Traccar fleet management solution
- CVE-2026-25648 Traccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File Upload
- CVE-2023-50729 An unrestricted file upload vulnerability in traccar leads to RCE
- CVE-2020-5246 LDAP injection vulnerability in Traccar GPS Tracking System
Sources
Also known as GHSA-33v4-5x2g-7mjm.