A flaw in Traccar allows authenticated users who can create or edit devices to set the device uniqueId to an absolute path. When an image for the device is uploaded, the application uses this uniqueId to build a filesystem path without ensuring that the resulting path remains under the configured media root. This results in the ability to write files outside the intended media directory, potentially overwriting critical system files or placing malicious files in executable locations.

The vulnerability affects the Traccar open‑source GPS tracking system, versions up to and including 6.11.1. No other vendor or product is listed, and no specific patch version has been released at the time of publication.

With a CVSS score of 6.5 the severity is moderate, and the EPSS score indicates a very low current exploitation probability (<1%). The flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated Traccar account with device creation or editing rights; the attacker then crafts a uniqueId containing an absolute path and uploads an image, causing the server to write the payload outside the media root.