Vulnerabilities

TI-2026-85186 CVE-2026-104203

Authentication bypass in Traccar exposes protected device media

LOW 34

Traccar is an open source GPS tracking system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00798 Published 2026-11-04 Fixed in 6.15.0 CWE-200

TI-2026-70717 CVE-2026-108738 · GHSA-jf89-8gjp-j4c9

Login CSRF in Traccar OpenID Connect callback

LOW 11

Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state pa…

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00113 Published 2026-10-11 No fix listed CWE-352

TI-2026-70716 CVE-2026-108737 · GHSA-2qrx-94v4-66vp

Weak password recovery in Traccar lets reset tokens act as sessions

HIGH 68

Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00321 Published 2026-10-11 No fix listed CWE-640

TI-2026-37957 CVE-2026-52852

Traccar: Uncontrolled Infinite Loop DoS via Group Parent Cycle

MEDIUM 62

Traccar is an open source GPS tracking system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0053 Published 2026-09-17 Fixed in 6.14.0 CWE-674

TI-2026-37956 CVE-2026-52851

Traccar: Authenticated Blind SQL Injection in DELETE /api/permissions

MEDIUM 64

Traccar is an open source GPS tracking system.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00389 Published 2026-09-17 Fixed in 6.14.0 CWE-89

TI-2026-36016 CVE-2026-48745

Traccar Client: silent configuration hijack via unverified deep link redirects all GPS telemetry

MEDIUM 42

Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00323 Published 2026-06-16 Fixed in 9.7.20 CWE-940

TI-2026-32282 CVE-2026-44314

Traccar: Missing edit authorization on device image upload allows read-only users to write files

MEDIUM 57

Traccar is an open source GPS tracking system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00185 Published 2026-05-26 Fixed in 6.13.0 CWE-863

TI-2026-22071 CVE-2026-27694

traccar allows stored HTML injection in notification emails

MEDIUM 58

Traccar is an open source GPS tracking system.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00162 Published 2026-05-05 Fixed in 6.13.0 CWE-79

TI-2026-22070 CVE-2026-27693

traccar allows XML injection in KML and GPX exports

MEDIUM 58

Traccar is an open source GPS tracking system.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00183 Published 2026-05-05 Fixed in 6.13.0 CWE-91

TI-2026-22026 CVE-2026-27644

traccar allows CSV formula injection via exported position data

MEDIUM 62

Traccar is an open source GPS tracking system.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00228 Published 2026-05-05 Fixed in 6.13.0 CWE-1236

TI-2026-20749 CVE-2026-25649

Traccar Vulnerable to Authorization Code Theft via Open Redirect in OIDC Provider Endpoints

HIGH 73

Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users can steal OAuth 2.0 authorization codes by exploiting an open redirect vulnerability in two…

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00162 Published 2026-02-23 No fix listed CWE-352

TI-2026-20748 CVE-2026-25648

Traccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File Upload

HIGH 73

Versions of the Traccar open-source GPS tracking system starting with 6.11.1 contain an issue in which authenticated users can execute arbitrary JavaScript in the context of other users' browsers by uploading malicious S…

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00318 Published 2026-02-23 No fix listed CWE-434

TI-2026-18945 CVE-2026-23521

Traccar vulnerable to Path Traversal and External Control of File Name or Path

MEDIUM 62

Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can create or edit devices can set a device `uniqueId` to an absolute path.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00371 Published 2026-02-23 No fix listed CWE-22

TI-2025-42386 CVE-2025-68930

Traccar Missing Origin Validation in WebSockets

MEDIUM 64

Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the `/api/socket` endpoint.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00556 Published 2026-02-23 No fix listed CWE-1385

TI-2025-38099 CVE-2025-61666

Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config File

HIGH 77

Traccar is an open source GPS tracking system.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.01282 Published 2025-10-02 Fixed in 6.9.0 CWE-22

TI-2024-07181 CVE-2024-7746 · GHSA-w4h5-9mg2-vv6r

Use of default credentials at Traccar fleet management solution

MEDIUM 44

Use of Default Credentials vulnerability in Tananaev Solutions Traccar Server on Administrator Panel modules allows Authentication Abuse.This issue affects the privileged transactions implemented by the Traccar solution…

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.00533 Published 2024-08-13 Fixed CWE-1392

TI-2024-20591 CVE-2024-31214

Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution

HIGH 76

Traccar is an open source GPS tracking system.

CVSS 3.1CRITICAL 9.7 Network No auth User interaction EPSS 0.17631 Published 2024-04-10 Fixed in 6.0 CWE-434

TI-2024-16326 CVE-2024-24809

Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type

HIGH 69

Traccar is an open source GPS tracking system.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.54413 Published 2024-04-10 Fixed in 6.0 CWE-27

TI-2023-27675 CVE-2023-50729

An unrestricted file upload vulnerability in traccar leads to RCE

MEDIUM 43

Traccar is an open source GPS tracking system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.006 Published 2024-01-15 Fixed in 5.11 CWE-434

TI-2021-04392 CVE-2021-21292

Unquoted Windows binary path in Traccar

LOW 28

Traccar is an open source GPS tracking system.

CVSS 3.1MEDIUM 6.3 Local No auth User interaction EPSS 0.00397 Published 2021-02-02 Fixed in 4.12 CWE-428

TI-2020-04302 CVE-2020-5246

LDAP injection vulnerability in Traccar GPS Tracking System

LOW 35

Traccar GPS Tracking System before version 4.9 has a LDAP injection vulnerability.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00852 Published 2020-07-14 Fixed in 4.9 CWE-90

TI-2019-04065 CVE-2019-5748 · GHSA-74f5-7pjw-4cgf

In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks.

MEDIUM 45

In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01714 Published 2019-01-09 No fix listed CWE-611

TI-2018-16100 CVE-2018-1000881 · GHSA-v228-g7xp-x783

Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of…

MEDIUM 49

Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in ComputedAttributesHandler.java that can result in Remote Command Execution.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03819 Published 2018-12-20 No fix listed CWE-94

Vulnerabilities

Filters