CVE-2026-104203 Details
Description
Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's MediaFilter Guice mapping and WebServer.java's Jetty ResourceServlet assign different routing meanings to path parameters at /api/media/*. An unauthenticated attacker who knows or guesses a device unique ID and media filename can insert a semicolon at the Servlet boundary, bypass MediaFilter's session and device authorization checks, and retrieve the protected media because Jetty still dispatches the noncanonical path to ResourceServlet. The demonstrated impact is read-only disclosure of a protected device media file; depending on the deployment and stored media, this could expose photographs, audio, video, or other uploaded files. The advisory does not establish directory listing, traversal, modification, account takeover, denial of service, or code execution. Reverse proxies that reject or rewrite semicolon path parameters may block the request. This issue is fixed in version 6.15.0.
A vulnerability in Traccar's media handling has been identified, affecting versions 5.1 prior to 6.15.0. The issue arises from a mismatch in how path parameters are routed in the MediaFilter and Jetty's ResourceServlet. This discrepancy allows an unauthenticated attacker to bypass authorization checks and access protected media files by inserting a semicolon at the Servlet boundary of the media API endpoint. The exploited files could include photographs, audio, video, or other uploaded documents, depending on the user's media storage. Reverse proxies that reject or modify semicolon path parameters may block this attack.
Users can update to Traccar version 6.15.0 or later, where this vulnerability has been fixed. For those unable to immediately upgrade, a temporary mitigation is to use a path-preserving reverse proxy that rejects semicolon path parameters before forwarding requests to Traccar.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/traccar/traccar/commit/f6f22ea32a7c6d51f2cdc923cca6d3b2621a205a | [email protected] | Source CodeVendor |
| https://github.com/traccar/traccar/releases/tag/v6.15.0 | [email protected] | Release NotesVendor |
| https://github.com/traccar/traccar/security/advisories/GHSA-w59q-j9pg-pw7x | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-288 | Authentication Bypass Using an Alternate Path or Channel | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Traccar | >= 5.1, < 6.15.0 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | [email protected] |