CVE-2024-31214

CVE-2024-31214 is a critical arbitrary file upload vulnerability affecting Traccar versions 5.1 through 5.12, an open-source GPS tracking system. Attackers can upload files with full control over content, directory, and extension, potentially leading to remote code execution, cross-site scripting (XSS), or denial of service (DoS). With a CVSS score of 9.6, this vulnerability is highly severe due to its network-based attack vector, low complexity, and high impact on confidentiality, integrity, and availability, exacerbated by Traccar's default self-registration and root privileges. Exploit code, including a Metasploit module, is publicly available, though there is currently no evidence of active exploitation, and community discussion and media coverage remain low.