Authenticated arbitrary file upload via device identifier traversal

Path traversal in Traccar Server before 6.0 allows remote authenticated users to write uploaded files outside the media directory. The uploadImage endpoint uses a device-controlled uniqueId as the storage path and derives the file extension directly from the supplied image subtype. An ordinary account can exploit the flaw, and default registration exposes that gate to remote attackers; placing HTML in the web root enables phishing or stored XSS, while command execution depends on server-side handling.