Vulnerabilities

TI-2026-32282 CVE-2026-44314

Traccar: Missing edit authorization on device image upload allows read-only users to write files

MEDIUM 57

Traccar is an open source GPS tracking system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00185 Published 2026-05-26 Fixed in 6.13.0 CWE-863

TI-2026-22071 CVE-2026-27694

traccar allows stored HTML injection in notification emails

MEDIUM 58

Traccar is an open source GPS tracking system.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00162 Published 2026-05-05 Fixed in 6.13.0 CWE-79

TI-2026-22070 CVE-2026-27693

traccar allows XML injection in KML and GPX exports

MEDIUM 58

Traccar is an open source GPS tracking system.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00183 Published 2026-05-05 Fixed in 6.13.0 CWE-91

TI-2026-22026 CVE-2026-27644

traccar allows CSV formula injection via exported position data

MEDIUM 62

Traccar is an open source GPS tracking system.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00228 Published 2026-05-05 Fixed in 6.13.0 CWE-1236

TI-2026-20749 CVE-2026-25649

Traccar Vulnerable to Authorization Code Theft via Open Redirect in OIDC Provider Endpoints

HIGH 73

Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users can steal OAuth 2.0 authorization codes by exploiting an open redirect vulnerability in two…

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00162 Published 2026-02-23 No fix listed CWE-352

TI-2026-20748 CVE-2026-25648

Traccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File Upload

HIGH 73

Versions of the Traccar open-source GPS tracking system starting with 6.11.1 contain an issue in which authenticated users can execute arbitrary JavaScript in the context of other users' browsers by uploading malicious S…

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00318 Published 2026-02-23 No fix listed CWE-434

TI-2026-18945 CVE-2026-23521

Traccar vulnerable to Path Traversal and External Control of File Name or Path

MEDIUM 62

Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can create or edit devices can set a device `uniqueId` to an absolute path.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00371 Published 2026-02-23 No fix listed CWE-22

TI-2025-42386 CVE-2025-68930

Traccar Missing Origin Validation in WebSockets

MEDIUM 64

Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the `/api/socket` endpoint.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00556 Published 2026-02-23 No fix listed CWE-1385

TI-2024-07181 CVE-2024-7746 · GHSA-w4h5-9mg2-vv6r

Use of default credentials at Traccar fleet management solution

MEDIUM 44

Use of Default Credentials vulnerability in Tananaev Solutions Traccar Server on Administrator Panel modules allows Authentication Abuse.This issue affects the privileged transactions implemented by the Traccar solution…

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.00533 Published 2024-08-13 Fixed CWE-1392

TI-2024-20591 CVE-2024-31214

Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution

HIGH 76

Traccar is an open source GPS tracking system.

CVSS 3.1CRITICAL 9.7 Network No auth User interaction EPSS 0.17631 Published 2024-04-10 Fixed in 6.0 CWE-434

TI-2023-27675 CVE-2023-50729

An unrestricted file upload vulnerability in traccar leads to RCE

MEDIUM 43

Traccar is an open source GPS tracking system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.006 Published 2024-01-15 Fixed in 5.11 CWE-434

TI-2021-04392 CVE-2021-21292

Unquoted Windows binary path in Traccar

LOW 28

Traccar is an open source GPS tracking system.

CVSS 3.1MEDIUM 6.3 Local No auth User interaction EPSS 0.00397 Published 2021-02-02 Fixed in 4.12 CWE-428

TI-2020-04302 CVE-2020-5246

LDAP injection vulnerability in Traccar GPS Tracking System

LOW 35

Traccar GPS Tracking System before version 4.9 has a LDAP injection vulnerability.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00852 Published 2020-07-14 Fixed in 4.9 CWE-90

Vulnerabilities

Filters