CVE-2026-104203
Deferred Deferred - Pending Action

Path Traversal in Traccar GPS Tracking System

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description
Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's MediaFilter Guice mapping and WebServer.java's Jetty ResourceServlet assign different routing meanings to path parameters at /api/media/*. An unauthenticated attacker who knows or guesses a device unique ID and media filename can insert a semicolon at the Servlet boundary, bypass MediaFilter's session and device authorization checks, and retrieve the protected media because Jetty still dispatches the noncanonical path to ResourceServlet. The demonstrated impact is read-only disclosure of a protected device media file; depending on the deployment and stored media, this could expose photographs, audio, video, or other uploaded files. The advisory does not establish directory listing, traversal, modification, account takeover, denial of service, or code execution. Reverse proxies that reject or rewrite semicolon path parameters may block the request. This issue is fixed in version 6.15.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-05
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-104203
EUVD
EUVD-2026-117100

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
traccar traccar >= 5.1, < 6.15.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-288 The product requires authentication, but the product has an alternate path or channel that does not require authentication.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Traccar versions 5.1 to 6.15.0. It involves a path parameter handling issue in WebModule.java's MediaFilter and WebServer.java's ResourceServlet. An unauthenticated attacker can bypass authorization checks by inserting a semicolon in the path, allowing them to access protected media files such as photos, audio, or video associated with a device.

Detection Guidance

Detecting this vulnerability requires checking Traccar versions between 5.1 and 6.15.0. Verify the installed version using Traccar's web interface or logs. Test for the vulnerability by attempting to access protected media files with a semicolon in the path, e.g., /api/media/device_id;filename.jpg. If the file is accessible without authentication, the system is vulnerable.

Impact Analysis

The vulnerability allows read-only access to protected media files stored on the device. If you use Traccar for GPS tracking, sensitive data like photographs, audio recordings, or videos could be exposed. This could lead to privacy breaches or unauthorized access to confidential information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized access to personal or sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. Exposure of such data due to this vulnerability may violate these regulations.

Mitigation Strategies

Upgrade Traccar to version 6.15.0 or later immediately. If upgrading is not possible, implement a reverse proxy that blocks or rewrites semicolon path parameters. Restrict access to the /api/media endpoint and review media file permissions to ensure only authorized users can access them.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104203. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...