CVE-2024-31214

🗓️ 10 Apr 2024 17:20:55Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 157 Views🌐 WEB

Traccar GPS tracking system allows arbitrary file upload, leading to remote code execution and XSS attacks, with full attacker control over file contents, directory, extension, and partial file name control. Default installation and self-registration exacerbate severity

Reporter	Title	Published	Views	Family All 14
zdt	Traccar 5.12 Remote Code Execution Exploit	24 Sep 202400:00	–	zdt
GithubExploit	Exploit for SQL Injection in Valvepress Automatic	30 Oct 202513:28	–	githubexploit
BDU FSTEC	The vulnerability of the Traccar GPS system’s application programming interface, related to the unlimited loading of dangerous type files, allows a violator to execute arbitrary code.	26 Aug 202400:00	–	bdu_fstec
Circl	CVE-2024-31214	26 Aug 202414:44	–	circl
CNNVD	Traccar 代码问题漏洞	10 Apr 202400:00	–	cnnvd
Cvelist	CVE-2024-31214 Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution	10 Apr 202417:20	–	cvelist
Metasploit	Traccar v5 Remote Code Execution (CVE-2024-31214 and CVE-2024-24809)	23 Aug 202400:00	–	metasploit
NVD	CVE-2024-31214	10 Apr 202418:15	–	nvd
Packet Storm	Traccar 5.12 Remote Code Execution	24 Sep 202400:00	–	packetstorm
Rapid7 Vulnerability Database (full)	CVE-2024-31214: Unrestricted Upload of File with Dangerous Type	10 Apr 202400:00	–	rapid7

NVD

Vulners

Vulnrichment

Node

traccar traccarRange5.1–5.12

[
  {
    "vendor": "traccar",
    "product": "traccar",
    "versions": [
      {
        "version": ">= 5.1, < 6.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/traccar/traccar/blob/master/src/main/java/org/traccar/model/Device.java
github	www.github.com/traccar/traccar/security/advisories/GHSA-3gxq-f2qj-c8v9
github	www.github.com/traccar/traccar/blob/v5.12/src/main/java/org/traccar/api/resource/DeviceResource.java
github	www.github.com/traccar/traccar/commit/3fbdcd81566bc72e319ec05c77cf8a4120b87b8f

Parameter	Position	Path	Description	CWE
Content-Type header with fn and path traversal	header	api/devices/{id}/image	Unrestricted file upload via image endpoint enabling path traversal to place cron file for NOP payload execution.	CWE-434
data body	header	api/devices/{id}/image	Unrestricted file upload via image endpoint enabling path traversal to place cron file for NOP payload execution.	CWE-434

17 Jun 2026 07:27Current

9.3Critical risk

Vulners AI Score9.3

CVSS 3.19.6

EPSS0.17631

SSVC

CWE-434