Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2026-104203: Traccar lets strangers view device media files
CVE-2026-104203 · published today
Summary
Versions of Traccar from 5.1 up to 6.15.0 can be tricked into showing photos, video or audio that belong to a tracked device without requiring a login. An attacker who guesses the device’s ID and file name can insert a special character in the web request to bypass the normal checks and read the file. Update Traccar to version 6.15.0 or later, or use a reverse‑proxy that blocks semicolon characters in URLs, to stop this from happening.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| traccar | traccar | >= 5.1, < 6.15.0 |
Original advisory text
Traccar: Authentication bypass via path parameters exposes protected device media
Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's MediaFilter Guice mapping and WebServer.java's Jetty ResourceServlet assign different routing meanings to path parameters at /api/media/*. An unauthenticated attacker who knows or guesses a device unique ID and media filename can insert a semicolon at the Servlet boundary, bypass MediaFilter's session and device authorization checks, and retrieve the protected media because Jetty still dispatches the noncanonical path to ResourceServlet. The demonstrated impact is read-only disclosure of a protected device media file; depending on the deployment and stored media, this could expose photographs, audio, video, or other uploaded files. The advisory does not establish directory listing, traversal, modification, account takeover, denial of service, or code execution. Reverse proxies that reject or rewrite semicolon path parameters may block the request. This issue is fixed in version 6.15.0.
References
- https://github.com/traccar/traccar/security/advisories/GHSA-w59q-j9pg-pw7x x_refsource_CONFIRM
- https://github.com/traccar/traccar/commit/f6f22ea32a7c6d51f2cdc923cca6d3b2621a20... x_refsource_MISC
- https://github.com/traccar/traccar/releases/tag/v6.15.0 x_refsource_MISC
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-200Information Exposure
CWE-288Authentication Bypass Using Alternate Path
Timeline
Published4 Nov 2026
Updated4 Nov 2026
First seen4 Nov 2026
Track software like this
Free during beta