CVE-2026-104203 Traccar: Authentication bypass via path parameters exposes protected device media

Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's MediaFilter Guice mapping and WebServer.java's Jetty ResourceServlet assign different routing meanings to path parameters at /api/media/. An unauthenticated attacker who knows or guesses a device unique ID and...