---
id: 3732
title: "[CVE-2025-61666] Traccar Unauthenticated LFI v5.8-v6.8.1"
cve: CVE-2025-61666
source_domain: projectblack.io
source_url: "https://projectblack.io/blog/jetty-addpath-lfi/"
published_at: "2025-10-01 11:28"
tags: ["lfi", "unauthenticated", "traccar", "cve-2025-61666", "jetty"]
phying_url: "https://phying.com/item/3732"
lang: en
---

# [CVE-2025-61666] Traccar Unauthenticated LFI v5.8-v6.8.1

## Summary

An accidental find: Traccar v5.8-v6.8.1 on Windows has an unauthenticated LFI (CVE-2025-61666) because a servlet bypasses Jetty's path checks. The post reads configs with LDAP passwords.

## Intelligence Metadata

- **Sources:** projectblack.io
- **CVE:** CVE-2025-61666
- **Published:** 2025-10-01 11:28
- **Original:** https://projectblack.io/blog/jetty-addpath-lfi/
- **Phying News:** https://phying.com/item/3732