CVE-2024-31214 Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution

🗓️ 10 Apr 2024 17:20:55Reported by GoogleType

osv🔗 osv.dev👁 33 Views

Traccar 5.1-5.12 allows arbitrary file uploads, leading to potential remote code execution, XSS, and DOS attack

Reporter	Title	Published	Views	Family All 14
0day.today	Traccar 5.12 Remote Code Execution Exploit	24 Sep 202400:00	–	zdt
GithubExploit	Exploit for SQL Injection in Valvepress Automatic	30 Oct 202513:28	–	githubexploit
BDU FSTEC	The vulnerability of the Traccar GPS system’s application programming interface, related to the unlimited loading of dangerous type files, allows a violator to execute arbitrary code.	26 Aug 202400:00	–	bdu_fstec
Circl	CVE-2024-31214	26 Aug 202414:44	–	circl
CNNVD	Traccar 代码问题漏洞	10 Apr 202400:00	–	cnnvd
CVE	CVE-2024-31214	10 Apr 202417:20	–	cve
Cvelist	CVE-2024-31214 Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution	10 Apr 202417:20	–	cvelist
Metasploit	Traccar v5 Remote Code Execution (CVE-2024-31214 and CVE-2024-24809)	24 Sep 202418:54	–	metasploit
NVD	CVE-2024-31214	10 Apr 202418:15	–	nvd
Packet Storm	Traccar 5.12 Remote Code Execution	24 Sep 202400:00	–	packetstorm

Source	Link
github	www.github.com/traccar/traccar/blob/master/src/main/java/org/traccar/model/Device.java
github	www.github.com/traccar/traccar/blob/v5.12/src/main/java/org/traccar/api/resource/DeviceResource.java
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31214.json
github	www.github.com/traccar/traccar/security/advisories/GHSA-3gxq-f2qj-c8v9
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-31214
github	www.github.com/traccar/traccar/commit/3fbdcd81566bc72e319ec05c77cf8a4120b87b8f

12 Apr 2026 09:49Current

9.3High risk

Vulners AI Score9.3

CVSS 3.19.6

EPSS0.22195