NewsPublished 27 Oct 2025

Jetty's addPath allows LFI in Windows - Traccar Unauthenticated LFI v5.8-v6.8.1

Source Reddit NetSec

Description

A Local File Inclusion (LFI) vulnerability exists in Traccar versions 5.8 through 6.8.1 on Windows systems due to Jetty's addPath method. This vulnerability allows unauthenticated attackers to read arbitrary files on the server by exploiting the way Jetty handles path additions. Although no known exploits are currently in the wild, the flaw can lead to sensitive information disclosure, potentially aiding further attacks. The vulnerability is specific to Windows environments and does not require authentication or user interaction, increasing its risk. European organizations using affected Traccar versions on Windows should prioritize mitigation. The threat is assessed as medium severity due to its impact on confidentiality and ease of exploitation. Countries with significant Traccar deployments and critical infrastructure monitoring are at higher risk.

Impact

For European organizations, this vulnerability could lead to unauthorized disclosure of sensitive data such as system configurations, user credentials, or operational logs, which could facilitate further attacks like privilege escalation or lateral movement. Organizations relying on Traccar for critical infrastructure monitoring, logistics, or fleet management could face operational disruptions if attackers leverage disclosed information to compromise systems. The unauthenticated nature of the vulnerability increases the attack surface, especially for externally accessible Traccar instances. Data privacy regulations such as GDPR heighten the consequences of data leakage incidents, potentially resulting in legal and reputational damage. The impact is particularly significant for sectors like transportation, utilities, and public services that use Traccar for real-time tracking and management. However, the lack of known exploits and the medium severity rating suggest that while the threat is real, immediate widespread exploitation is not confirmed, allowing time for mitigation.

Defensive guidance

European organizations should immediately verify if they are running Traccar versions between 5.8 and 6.8.1 on Windows systems. If so, they should prioritize upgrading to the latest Traccar version where this vulnerability is addressed or apply any available patches from the vendor. In the absence of official patches, organizations can mitigate risk by restricting network access to Traccar instances, especially from untrusted external networks, using firewalls or VPNs. Implementing strict input validation and path sanitization at the application or web server level can reduce exploitation risk. Monitoring logs for unusual file access patterns or suspicious HTTP requests targeting addPath functionality can help detect attempted exploitation. Additionally, isolating Traccar servers in segmented network zones limits potential lateral movement if compromised. Regularly auditing and updating third-party components like Jetty embedded in Traccar is critical to prevent similar vulnerabilities. Finally, organizations should review and harden file permissions on Windows hosts to minimize sensitive file exposure.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 27 Oct 2025, 08:35 UTC

Technical details

References

Community reviews

Related threats