Traccar vulnerabilities
We track 11 vulnerabilities in Traccar products across 3 products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on November 11, 2026.
Latest Traccar vulnerabilities
- 7.4 High severity
Traccar: Improper Authentication
Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers
- 7.5 High severity
traccar: Exposure of Sensitive Information to an Unauthorized Actor
Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's MediaFilter Guice mapping and WebServer.java's Jetty ResourceServlet assign different routing meanings to path parameters at /api/media/*. An unauthenticated attacker who kn
- 7.1 High severity
traccar: Improper Neutralization of Special Elements used in an SQL Command
Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. Permission(LinkedHashMap<Str
- 9.3 Critical severity
traccar-client: Improper Verification of Source of a Communication Channel
Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. In versions 9.7.19 and below, a single crafted deep link can silently hijack all GPS tracking parameters and redirect telemetry
- 8.7 High severity
traccar: URL Redirection to Untrusted Site
Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users can steal OAuth 2.0 authorization codes by exploiting an open redirect vulnerability in two OIDC-related endpoints. The `redirect_u
- 8.7 High severity
traccar: Improper Neutralization of Input During Web Page Generation
Versions of the Traccar open-source GPS tracking system starting with 6.11.1 contain an issue in which authenticated users can execute arbitrary JavaScript in the context of other users' browsers by uploading malicious SVG files as device images. The applicati
- 8.7 High severity
traccar: Improper Limitation of a Pathname to a Restricted Directory
Traccar is an open source GPS tracking system. Default installs of Traccar on Windows between versions 6.1- 6.8.1 and non default installs between versions 5.8 - 6.0 are vulnerable to unauthenticated local file inclusion attacks which can lead to leakage of pa
- 9.8 Critical severity
Server: Improper Authentication
Use of Default Credentials vulnerability in Tananaev Solutions Traccar Server on Administrator Panel modules allows Authentication Abuse.This issue affects the privileged transactions implemented by the Traccar solution that should otherwise be protected by th
- 9.6 Critical severity
traccar: Unrestricted Upload of File with Dangerous Type
Traccar is an open source GPS tracking system. Traccar versions 5.1 through 5.12 allow arbitrary files to be uploaded through the device image upload API. Attackers have full control over the file contents, full control over the directory where the file is sto
- 8.5 High severity
traccar: Path Traversal: 'dir/../../filename'
Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by regis
- 9.8 Critical severity
traccar: Unrestricted Upload of File with Dangerous Type
Traccar is an open source GPS tracking system. Prior to 5.11, Traccar is affected by an unrestricted file upload vulnerability in File feature allows attackers to execute arbitrary code on the server. This vulnerability is more prevalent because Traccar is rec