traccar

Traccar Overview Traccar is an open source GPS tracking system. This repository contains Java-based back-end service. It supports more than 200 GPS protocols and more than 2000 models of GPS tracking devices. Traccar can be used with any major SQL database system. It also provides easy to use RES...

CVE-2024-24809-Proof-of-concept

CVE-2024-24809 Detail Description Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by...

CVE-2025-68930

🔍 Analysis of CVE-2025-68930: WebSocket Hijacking Vulnerability in Traccar The CVE-2025-68930 exposes a critical Cross-Site WebSocket Hijacking CSWSH vulnerability in Traccar , the open-source GPS tracking system. Below are the key details: 🛡️ Vulnerability Details Affected endpoint : /api/socket...

Traccar - Unrestricted File Upload

Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this...

CVE-2026-126777

Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in vi...

CVE-2026-126777 Traccar 3.15 before 6.17.0 Authentication Bypass via Empty LDAP Password

Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in vi...

EUVD-2026-123771

Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in vi...

CVE-2026-126777 Traccar 3.15 before 6.17.0 Authentication Bypass via Empty LDAP Password

Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in vi...

CVE-2026-126777

Traccar version 3.15 before 6.17.0 is vulnerable to an authentication bypass in the LdapProvider.login() function. The root cause is a failure to reject empty passwords when LDAP authentication is enabled, allowing the system to perform unauthenticated binds against directories that permit them. ...

CVE-2026-126777

Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in vi...

CVE-2026-126777: Traccar: Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject…

Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in vi...

PT-2026-145429

Name of the Vulnerable Software and Affected Versions Traccar versions 3.15 through 6.16.x Description An authentication bypass exists in the LdapProvider.login function when LDAP authentication is enabled. The system fails to reject empty passwords, which leads to LDAP binds being performed as...

VulnCheck KEV: CVE-2026-104203

Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's MediaFilter Guice mapping and WebServer.java's Jetty ResourceServlet assign different routing meanings to path parameters at /api/media/. An unauthenticated attacker who knows or guesses a device unique ID and...

VulnCheck KEV: CVE-2024-24809

Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this...

CVE-2026-104203

Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's MediaFilter Guice mapping and WebServer.java's Jetty ResourceServlet assign different routing meanings to path parameters at /api/media/. An unauthenticated attacker who knows or guesses a device unique ID and...

CVE-2026-104203

The open source GPS tracking system Traccar (versions 5.1 until 6.15.0) contains a vulnerability where an unauthenticated attacker can bypass session and device authorization checks. The root cause is a discrepancy in routing meanings for path parameters at /api/media/* between WebModule.java's M...

CVE-2026-104203 Traccar: Authentication bypass via path parameters exposes protected device media

Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's MediaFilter Guice mapping and WebServer.java's Jetty ResourceServlet assign different routing meanings to path parameters at /api/media/. An unauthenticated attacker who knows or guesses a device unique ID and...

CVE-2026-104203 Traccar: Authentication bypass via path parameters exposes protected device media

Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's MediaFilter Guice mapping and WebServer.java's Jetty ResourceServlet assign different routing meanings to path parameters at /api/media/. An unauthenticated attacker who knows or guesses a device unique ID and...

PT-2026-137127

Name of the Vulnerable Software and Affected Versions Traccar versions 5.1 through 6.14.9 Description An issue exists where the MediaFilter Guice mapping in WebModule.java and the Jetty ResourceServlet in WebServer.java interpret path parameters differently at the '/api/media/' endpoint. An...

CVE-2026-119276 vulnerabilities

Vulnerabilities for packages: debezium-server, debezium, request-9047-keycloak-fips, traccar-fips, trino, airbyte-platform, keycloak-fips, reposilite, airbyte-platform-fips, camunda, traccar, camunda-zeebe, zipkin, keycloak...