CVE-2025-61666

Deeper analysis

Traccar, an open source GPS tracking system, contains a path traversal vulnerability (CWE-22) that enables unauthenticated local file inclusion. Default installations on Windows in versions 6.1 through 6.8.1 are affected because the web override feature is enabled by default, while versions 5.8 through 6.0 are affected only when the configuration explicitly sets <entry key='web.override'>./override</entry>. The flaw resides in DefaultOverrideServlet and permits reading arbitrary files on the filesystem, including the Traccar configuration file that may contain passwords.

An unauthenticated remote attacker can supply crafted paths to the override servlet and retrieve sensitive files without authentication or user interaction. Successful exploitation yields disclosure of configuration secrets or other filesystem contents but does not permit modification or service disruption. The CVSS 4.0 score of 8.7 reflects the network-accessible, low-complexity nature of the attack.

The official advisory GHSA-hprc-rph8-fj87 and the Traccar 6.9.0 release remove the vulnerable servlet code entirely. Administrators are advised to upgrade to 6.9.0 or later; non-default installations should also verify that the web.override setting is absent or disabled. The associated EPSS score rose from a low baseline to a peak of 0.0324, indicating increased exploitation interest after disclosure.