Authenticated users can execute arbitrary JavaScript in the browsers of other users by uploading malicious SVG files to the Traccar GPS tracking system, creating a significant cross-site scripting risk.

This vulnerability involves improper neutralization of input during web page generation (CWE-79) and unrestricted file uploads (CWE-434). Authenticated users can bypass security controls by uploading unsanitized SVG files that execute malicious scripts when viewed by other users.

Successful exploitation allows an attacker to perform actions on behalf of other users, potentially including administrators, which may lead to unauthorized data access or account takeover. With a CVSS score of 8.7, this high-severity flaw poses a substantial risk to the integrity and confidentiality of the tracking environment.

Immediate Action: Monitor the official Traccar GitHub security advisories for the release of a patch and apply it immediately upon availability.

Proactive Monitoring: Review web server access logs for suspicious file upload activity, particularly involving SVG files, and implement strict file type validation on the server side.

Compensating Controls: Configure a Content Security Policy (CSP) to restrict script execution and utilize a Web Application Firewall (WAF) to inspect and block malicious SVG uploads.

Public Exploit Available: Unknown

Given the potential for cross-site scripting to compromise user sessions and administrative functions, organizations should restrict file upload permissions to trusted users only until a permanent patch is released. Prioritize monitoring of user-submitted content to detect potential abuse of the SVG upload feature.