How severe is CVE-2024-24809?

CVE-2024-24809 has a CVSS 3.x base score of 8.5, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability low.

Is CVE-2024-24809 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 54% (99th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2024-24809?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2024-24809 have an EU (EUVD) identifier?

Yes. CVE-2024-24809 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-22183.

When was CVE-2024-24809 published?

CVE-2024-24809 was published on 2024-04-10 and last updated on 2026-06-17.

CVE-2024-24809

CVE-2024-24809 is a high-severity vulnerability with a CVSS 3.x base score of 8.5. Its EPSS exploit-prediction score of 54% places it in the 99th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-27.

Key facts

Severity: High (CVSS 3.x base score 8.5)
EPSS exploit prediction: 54% (99th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-22183
Weakness: CWE-27
Published: 2024-04-10
Last modified: 2026-06-17

Description

Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this vulnerability to upload files with the prefix `device.` under any folder. Attackers can use this vulnerability for phishing, cross-site scripting attacks, and potentially execute arbitrary commands on the server. Version 6.0 contains a patch for the issue.

Frequently asked questions

What is CVE-2024-24809?: Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this vulnerability to upload files with the prefix `device.` under any folder. Attackers can use this vulnerability for phishing, cross-site scripting attacks, and potentially execute arbitrary commands on the server. Version 6.0 contains a patch for the issue.
How severe is CVE-2024-24809?: CVE-2024-24809 has a CVSS 3.x base score of 8.5, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability low.
Is CVE-2024-24809 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 54% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2024-24809?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2024-24809 have an EU (EUVD) identifier?: Yes. CVE-2024-24809 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-22183.
When was CVE-2024-24809 published?: CVE-2024-24809 was published on 2024-04-10 and last updated on 2026-06-17.

References

Other CWE-27 vulnerabilities

CVE-2024-21896 — Critical (CVSS 9.8): The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the…
CVE-2025-10438 — High (CVSS 8.6): Path Traversal: 'dir/../../filename' vulnerability in Yordam Information Technology Consulting Education and Electrical…
CVE-2025-58761 — High (CVSS 8.6): Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The `real_pms_image_proxy` endpoint in…
CVE-2024-43658 — High (CVSS 7.2): Patch traversal, External Control of File Name or Path vulnerability in Iocharger Home allows deletion of arbitrary…
CVE-2023-20090 — Medium (CVSS 6.7): A vulnerability in Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to elevate privileges…
CVE-2025-52237 — Medium (CVSS 6.5): An issue in the component /stl/actions/download?filePath of SSCMS v7.3.1 allows attackers to execute a directory…

Browse all CWE-27 vulnerabilities →