Traccar

Products

Exploited and recent CVEs

• CVE-2026-104203 High 7.5 Traccar: Authentication bypass via path parameters exposes protected device media 0.8%
• CVE-2026-108738 Medium 4.2 Traccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback 0.1%
• CVE-2026-108737 Medium 6.8 Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion 0.3%
• CVE-2026-52852 Medium 6.5 Traccar: Uncontrolled Infinite Loop DoS via Group Parent Cycle 0.5%
• CVE-2026-52851 High 7.1 Traccar: Authenticated Blind SQL Injection in DELETE /api/permissions 0.4%
• CVE-2026-48745 Critical 9.3 Traccar Client: silent configuration hijack via unverified deep link redirects all GPS telemetry 0.3%
• CVE-2026-44314 Medium 5.3 Traccar: Missing edit authorization on device image upload allows read-only users to write files 0.2%
• CVE-2026-27694 Medium 5.4 traccar allows stored HTML injection in notification emails 0.2%
• CVE-2026-27693 Medium 5.4 traccar allows XML injection in KML and GPX exports 0.2%
• CVE-2026-27644 Medium 6.5 traccar allows CSV formula injection via exported position data 0.2%
• CVE-2026-25649 High 7.3 Traccar Vulnerable to Authorization Code Theft via Open Redirect in OIDC Provider Endpoints 0.2%
• CVE-2026-25648 High 8.7 Traccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File Upload 0.3%
• CVE-2026-23521 Medium 6.5 Traccar vulnerable to Path Traversal and External Control of File Name or Path 0.4%
• CVE-2025-68930 High 7.1 Traccar Missing Origin Validation in WebSockets 0.6%
• CVE-2025-61666 High 8.7 Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config File 1.3%
• CVE-2024-7746 Critical 9.5 Use of default credentials at Traccar fleet management solution 0.5%
• CVE-2024-31214 Critical 9.7 Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution 17.6%
• CVE-2024-24809 High 8.5 Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type 54.4%
• CVE-2023-50729 High 8.5 An unrestricted file upload vulnerability in traccar leads to RCE 0.6%
• CVE-2021-21292 Medium 5.5 Unquoted Windows binary path in Traccar 0.4%
• CVE-2020-5246 High 7.7 LDAP injection vulnerability in Traccar GPS Tracking System 0.9%