Read the docs
TI-2026-85186 Aliases CVE-2026-104203

Authentication bypass in Traccar exposes protected device media

Priority LOW 34CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-288.

Summary

Traccar, an open source GPS tracking system, from 5.1 before 6.15.0 has an authentication bypass in its media routing (CWE-288). An unauthenticated remote attacker who knows or guesses a device unique ID and media filename can read protected device media, such as photographs, audio or video, because a semicolon in the path skips the authorization filter. The disclosure is read-only and the advisory does not establish directory listing, traversal or code execution.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's MediaFilter Guice mapping and WebServer.java's Jetty ResourceServlet assign different routing meanings to path parameters at /api/media/*. An unauthenticated attacker who knows or guesses a device unique ID and media filename can insert a semicolon at the Servlet boundary, bypass MediaFilter's session and device authorization checks, and retrieve the protected media because Jetty still dispatches the noncanonical path to ResourceServlet. The demonstrated impact is read-only disclosure of a protected device media file; depending on the deployment and stored media, this could expose photographs, audio, video, or other uploaded files. The advisory does not establish directory listing, traversal, modification, account takeover, denial of service, or code execution. Reverse proxies that reject or rewrite semicolon path parameters may block the request. This issue is fixed in version 6.15.0.

Why it matters now

EPSS 0.00798 56th percentileScored 2026-11-07
Fix Fixed traccar (traccar): 6.15.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
traccartraccar5.1 to before 6.15.06.15.0Patch availableCNA
  • traccar Vendortraccar Affected 5.1 to before 6.15.0 Fixed in 6.15.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*——traccar
  • cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:* Versions — — ·traccar

Remediation

Upgrade traccar to version 6.15.0, which fixes the issue. Reverse proxies that reject or rewrite semicolon path parameters may block the request.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA traccar (traccar) Fixed in 6.15.0

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-104203
  2. 2026-11-06 Priority changed: MEDIUM → LOW

References

Other 3

  • TI-2025-38099 Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config File CVSS 4.0HIGH 8.7
  • TI-2024-20591 Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution CVSS 3.1CRITICAL 9.7
  • TI-2026-20749 Traccar Vulnerable to Authorization Code Theft via Open Redirect in OIDC Provider Endpoints CVSS 3.1HIGH 8.7
  • TI-2026-20748 Traccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File Upload CVSS 3.1HIGH 8.7
  • TI-2024-16326 Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type CVSS 3.1HIGH 8.5
  • TI-2026-70716 Weak password recovery in Traccar lets reset tokens act as sessions CVSS 4.0HIGH 7.6
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences