Traccar’s image upload endpoint performs device authorization but skips the edit permission check that normally protects against modification by non‑admin users. This oversight, captured as a CWE‑863 flaw, allows a read‑only user to upload a new image that replaces the existing device image under the server media directory. The compromise is limited to integrity; the attacker cannot read data or execute code, but the altered image affects UI display and any downstream processes that rely on the image file. The vulnerability exists only for authenticated sessions and does not provide broader system access.

The vendor is Traccar. The impacted product is the Traccar GPS tracking system. Any installation of Traccar running a version earlier than 6.13.0 is vulnerable. Versions 6.13.0 and later include a fix that re‑enforces the edit permission on the upload route.

The CVSS score of 5.3 denotes moderate severity. No EPSS score is reported, and the weakness is not currently listed in the CISA KEV catalog. Attackers would need to authenticate to a Traccar account that has read‑only role but not edit rights, which is typical for many deployment scenarios. Once authenticated, the attacker can upload an image of their choice and overwrite the device’s stored image file. The lack of secrecy or privilege escalation in the flaw means the risk is primarily to integrity and downstream workflows rather than to confidentiality or availability, but the ease of exploitation via a web form makes it a practical threat in environments where read‑only users are plentiful.