traccar

9 results · Clear filters · Feed

• Medium 4.2
  CVE-2026-108738

  Traccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback

  Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state parameter. Attackers can induce a victim'…

  traccar traccar
  Oct 11, 2026
• Medium 6.8
  CVE-2026-108737

  Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion

  Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full …

  traccar traccar
  Oct 11, 2026
• Medium 6.5
  CVE-2026-52852

  Traccar: Uncontrolled Infinite Loop DoS via Group Parent Cycle

  Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hierarchy and request a trips or stops report for a device in that hierarchy. org.tracc…

  traccar traccar
  Sep 17, 2026
• Medium 5.3
  CVE-2026-44314

  Traccar: Missing edit authorization on device image upload allows read-only users to write files

  Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.Permission(User.class, getUserId(), Device.class) and then immediately streams the uploaded body into mediaManager.c…

  traccar traccar
  May 26, 2026
• Medium 5.4
  CVE-2026-27694

  traccar allows stored HTML injection in notification emails

  Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the email notification templates insert user-controlled device, geofence, and driver names into HTML email output without proper escaping. An atta…

  traccar traccar
  May 5, 2026
• Medium 5.4
  CVE-2026-27693

  traccar allows XML injection in KML and GPX exports

  Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX export functionality writes device names to XML output without proper escaping. An attacker with low privileges can create a devic…

  traccar traccar
  May 5, 2026
• Medium 6.5
  CVE-2026-27644

  traccar allows CSV formula injection via exported position data

  Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality writes position data, including user-controlled device and computed attributes, to CSV output without proper escaping. An attacker can inject sp…

  traccar traccar
  May 5, 2026
• Medium 6.5
  CVE-2026-23521

  Traccar vulnerable to Path Traversal and External Control of File Name or Path

  Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can create or edit devices can set a device `uniqueId` to an absolute path. When uploading a device image, Traccar uses that `…

  traccar traccar
  Feb 23, 2026
• Medium 5.5
  CVE-2021-21292

  Unquoted Windows binary path in Traccar

  Traccar is an open source GPS tracking system. In Traccar before version 4.12 there is an unquoted Windows binary path vulnerability. Only Windows versions are impacted. Attacker needs write access to the filesystem on the host machine. If Java path includes …

  traccar traccar
  Feb 2, 2021