Read the docs
TI-2026-36016 Aliases CVE-2026-48745

Traccar Client: silent configuration hijack via unverified deep link redirects all GPS telemetry

Priority MEDIUM 42CWE-940Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. In versions 9.7.19 and below, a single crafted deep link can silently hijack all GPS tracking parameters and redirect telemetry to an attacker-controlled server. The app registers a custom org.traccar.client://config deep-link scheme that silently writes attacker-supplied parameters (server URL, device ID, accuracy, distance, and interval) into the app's persistent configuration with no confirmation, notification, or visual indication. A single crafted link delivered via SMS, email, a webpage, or any installed app can therefore reconfigure the app the moment the victim taps it, with no special permissions required. As a result, an attacker can covertly redirect all of the victim's GPS telemetry to their own server at maximum precision and frequency, and the change persists across restarts. This gives the attacker continuous, real-time tracking of the victim's location. This issue has been fixed in version 9.7.20.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00323 25th percentileScored 2026-11-07
Fix Fixed traccar-client (traccar): 9.7.20

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
traccartraccar-clientbefore 9.7.209.7.20Patch availableCNA
  • traccar-client Vendortraccar Affected before 9.7.20 Fixed in 9.7.20 Patch available CNA

Remediation

  • Fix · CNA traccar-client (traccar) Fixed in 9.7.20

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48745

References

Other 2

  • TI-2025-38099 Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config File CVSS 4.0HIGH 8.7
  • TI-2024-20591 Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution CVSS 3.1CRITICAL 9.7
  • TI-2026-20749 Traccar Vulnerable to Authorization Code Theft via Open Redirect in OIDC Provider Endpoints CVSS 3.1HIGH 8.7
  • TI-2026-20748 Traccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File Upload CVSS 3.1HIGH 8.7
  • TI-2024-16326 Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type CVSS 3.1HIGH 8.5
  • TI-2026-70716 Weak password recovery in Traccar lets reset tokens act as sessions CVSS 4.0HIGH 7.6
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences