CVE-2023-50729

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Traccar is an open source GPS tracking system. Prior to 5.11, Traccar is affected by an unrestricted file upload vulnerability in File feature allows attackers to execute arbitrary code on the server. This vulnerability is more prevalent because Traccar is recommended to run web servers as root user. It is also more dangerous because it can write or overwrite files in arbitrary locations. Version 5.11 was published to fix this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
traccar	traccar	< 5.11

References

https://github.com/traccar/traccar/security/advisories/GHSA-pqf7-8g85-vx2qThird Party Advisory
https://github.com/traccar/traccar/security/advisories/GHSA-pqf7-8g85-vx2qThird Party Advisory

Timeline

Published: Jan 15, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-50735.4The iframe forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'iframe' shortcode in versions up to, and includi CVE-2023-507307.5Grackle is a GraphQL server written in functional Scala, built on the Typelevel stack. The GraphQL specification requires that GraphQL fragm CVE-2023-507319.1MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the `put` method in `mindsdb/mindsdb/api/http/namespaces/fi CVE-2023-507326.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute a Velocity CVE-2023-507338.6A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Web Services feature of newer Lexmark devices.CVE-2023-507349.0A buffer overflow vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged CVE-2023-507359.0A heap corruption vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged CVE-2023-507369.0A memory corruption vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leverag CVE-2023-507379.1The SE menu contains information used by Lexmark to diagnose device errors. A vulnerability in one of the SE menu routines can be leveraged CVE-2023-507384.3A new feature to prevent Firmware downgrades was recently added to some Lexmark products. A method to override this downgrade protection ha CVE-2023-507398.8A buffer overflow vulnerability has been identified in the Internet Printing Protocol (IPP) in various Lexmark devices. The vulnerability ca CVE-2023-50749.8Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.2