CVE-2023-50729 is a high severity unrestricted file upload flaw in Traccar, the open source GPS tracking system, scored 8.4. It can lead to arbitrary code execution on the server. The advisory lists 5.10 as affected and says 5.11 fixes it, so upgrade and avoid running Traccar as root.
What's affected
The record says Traccar before 5.11 is affected, and version 5.11 was published to fix the vulnerability. The GitHub advisory lists 5.10 as the affected version. The two are consistent for current deployments, but if you run an older release, treat it as affected too. The advisory was published on 2024-01-14, the record on 2024-01-15.
NVD scores it 8.4 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H. The advisory gives the same score. Note that the vector requires high privileges and user interaction, so this is not an anonymous flaw.
The File feature can write or overwrite files in arbitrary locations. The advisory says the impact is greater because Traccar is commonly recommended to run as root. Its listed workaround is to sanitize the upload path. The advisory ties the issue to CWE-434 and CWE-23.
How to check if you're exposed
Check the version on the server or in the web interface's about page. If you run it from the command line, look at the install directory name or the jar. On Linux:
ls /opt/traccar/lib | grep tracker-server
ps -o user,cmd -C java | grep -i traccar
The first shows the build. The second shows which account runs Traccar. If it is root, a successful file write has the greatest possible reach.
Also check who has accounts on the instance. Because high privileges are needed, a list of administrators and users with file feature access tells you how many people could use the flaw.
What to do now
- Upgrade Traccar to 5.11 or later.
- Run Traccar under a dedicated unprivileged account, not as root.
- Reduce the number of administrator accounts and require strong, unique passwords.
- Put the web interface behind a VPN or an allow list if public access is not needed.
- Review the file storage area for files you do not recognize.
Why it matters
The weakness is unrestricted upload of a file with a dangerous type, CWE-434. The advisory also lists a path traversal weakness, which explains how a file can land outside the intended folder. Together they allow an upload to overwrite files in arbitrary locations.
Writing a file is often one step from running code. If the process has permission to place a file where the system will execute it or load it, an upload turns into execution. That is why the root user warning in the advisory matters.
The record shows no CISA Known Exploited Vulnerabilities listing, and the advisory does not report exploitation in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is Traccar 5.10 the only affected version?
The advisory names 5.10. The record says versions before 5.11. Upgrade to 5.11 or later whichever you run.
Does it need a login?
The vector requires high privileges and user interaction, so an attacker needs an administrative account or a person to take an action.
Sources
Last reviewed: 19 October 2026.
