CVE-2025-61666

Traccar is an open source GPS tracking system. Default installs of Traccar on Windows between versions 6.1- 6.8.1 and non default installs between versions 5.8 - 6.0 are vulnerable to unauthenticated local file inclusion attacks which can lead to leakage of passwords or any file on the file system including the Traccar configuration file. Versions 5.8 - 6.0 are only vulnerable if <entry key='web.override'>./override</entry> is set in the configuration file. Versions 6.1 - 6.8.1 are vulnerable by default as the web override is enabled by default. The vulnerable code is removed in version 6.9.0.

• CWE-22

• https://github.com/traccar/traccar/blob/v6.8.1/src/main/java/org/traccar/web/DefaultOverrideServlet.java
• https://github.com/traccar/traccar/security/advisories/GHSA-hprc-rph8-fj87
• https://projectblack.io/blog/jetty-addpath-lfi

Published

Oct 2, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-6166A vulnerability was found in frdel Agent-Zero up to 0.8.4. I…5.1
• CVE-2025-61661A vulnerability has been identified in the GRUB (Grand Unifi…4.8
• CVE-2025-61662A Use-After-Free vulnerability has been discovered in GRUB's…7.8
• CVE-2025-61663A vulnerability has been identified in the GRUB2 bootloader'…4.9
• CVE-2025-61664A vulnerability in the GRUB2 bootloader has been identified …4.9
• CVE-2025-61665WeGIA is an open source web manager with a focus on charitab…7.5
• CVE-2025-61667The Datadog Agent collects events and metrics from hosts and…7
• CVE-2025-61668Volto is a ReactJS-based frontend for the Plone Content Mana…8.7
• CVE-2025-61669Jupyter Server is the backend for Jupyter web applications. …6.1
• CVE-2025-6167A vulnerability classified as critical has been found in the…9.8
• CVE-2025-61670Wasmtime is a runtime for WebAssembly. Wasmtime 37.0.0 and 3…3.3
• CVE-2025-61671Rejected reason: Further research determined the issue is no…