Read the docs
TI-2021-04392 Aliases CVE-2021-21292

Unquoted Windows binary path in Traccar

Priority LOW 28CWE-428Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-428.

Summary

Traccar is an open source GPS tracking system. In Traccar before version 4.12 there is an unquoted Windows binary path vulnerability. Only Windows versions are impacted. Attacker needs write access to the filesystem on the host machine. If Java path includes a space, then attacker can lift their privilege to the same as Traccar service (system). This is fixed in version 4.12.

Why it matters now

EPSS 0.00397 34th percentileScored 2026-11-07
Fix Fixed traccar (traccar): 4.12

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
traccartraccarbefore 4.124.12Patch availableCNA
  • traccar Vendortraccar Affected before 4.12 Fixed in 4.12 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*before 4.12Vulnerabletraccar
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:* Versions before 4.12 Vulnerable ·traccar
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA traccar (traccar) Fixed in 4.12

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21292

References

Patch 1

Advisory 1

Other 1

  • TI-2024-20591 Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution CVSS 3.1CRITICAL 9.7
  • TI-2026-20749 Traccar Vulnerable to Authorization Code Theft via Open Redirect in OIDC Provider Endpoints CVSS 3.1HIGH 8.7
  • TI-2026-20748 Traccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File Upload CVSS 3.1HIGH 8.7
  • TI-2025-42386 Traccar Missing Origin Validation in WebSockets CVSS 3.1HIGH 7.1
  • TI-2026-22026 traccar allows CSV formula injection via exported position data CVSS 3.1MEDIUM 6.5
  • TI-2026-18945 Traccar vulnerable to Path Traversal and External Control of File Name or Path CVSS 3.1MEDIUM 6.5
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences