CVE-2024-24809

CVE-2024-24809 is a critical path traversal and unrestricted file upload vulnerability affecting Traccar GPS tracking systems prior to version 6.0. Attackers can register an account, then upload malicious files with a specific prefix to any directory, enabling phishing, cross-site scripting, and potential arbitrary command execution. With a CVSS score of 8.5 (HIGH) and an EPSS score indicating high exploitability, this vulnerability is easily exploitable over the network with low privileges and no user interaction. While not yet on the KEV catalog, public exploit modules exist for Metasploit and Nuclei, indicating a high likelihood of future exploitation, despite limited community discussion or media coverage to date.