Traccar vulnerabilities

Products

• Traccar 20
• Server 3

Newest

• traccar Traccar: Authentication bypass via path parameters exposes protected device media CVE-2026-104203 7.5 HighNovember 4, 2026
• traccar Traccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback CVE-2026-108738 2.3 LowOctober 11, 2026
• traccar Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion CVE-2026-108737 7.6 HighOctober 11, 2026
• traccar Traccar: Uncontrolled Infinite Loop DoS via Group Parent Cycle CVE-2026-52852 6.5 MediumSeptember 17, 2026
• traccar Traccar: Authenticated Blind SQL Injection in DELETE /api/permissions CVE-2026-52851 7.1 HighSeptember 17, 2026
• traccar traccar-client Traccar Client: silent configuration hijack via unverified deep link redirects all GPS telemetry CVE-2026-48745 9.3 CriticalJune 16, 2026
• traccar Traccar: Missing edit authorization on device image upload allows read-only users to write files CVE-2026-44314 5.3 MediumMay 26, 2026
• traccar traccar allows stored HTML injection in notification emails CVE-2026-27694 5.4 MediumMay 5, 2026
• traccar traccar allows XML injection in KML and GPX exports CVE-2026-27693 5.4 MediumMay 5, 2026
• traccar traccar allows CSV formula injection via exported position data CVE-2026-27644 6.5 MediumMay 5, 2026
• traccar Traccar Vulnerable to Authorization Code Theft via Open Redirect in OIDC Provider Endpoints CVE-2026-25649 7.3 HighFebruary 23, 2026
• traccar Traccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File Upload CVE-2026-25648 8.7 HighFebruary 23, 2026
• traccar Traccar vulnerable to Path Traversal and External Control of File Name or Path CVE-2026-23521 6.5 MediumFebruary 23, 2026
• traccar Traccar Missing Origin Validation in WebSockets CVE-2025-68930 Public exploit 7.1 HighFebruary 23, 2026
• traccar Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config File CVE-2025-61666 8.7 HighOctober 2, 2025
• traccar server, traccar +1 more Use of default credentials at Traccar fleet management solution CVE-2024-7746 9.5 CriticalAugust 13, 2024
• traccar Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution CVE-2024-31214 Public exploit EPSS 17.6% 9.7 CriticalApril 10, 2024
• traccar Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type CVE-2024-24809 Public exploit EPSS 54.4% 8.5 HighApril 10, 2024
• traccar An unrestricted file upload vulnerability in traccar leads to RCE CVE-2023-50729 8.5 HighJanuary 15, 2024
• traccar Unquoted Windows binary path in Traccar CVE-2021-21292 5.5 MediumFebruary 2, 2021
• traccar LDAP injection vulnerability in Traccar GPS Tracking System CVE-2020-5246 7.7 HighJuly 14, 2020
• traccar server In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks. CVE-2019-5748 9.8 CriticalJanuary 9, 2019
• traccar server Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation... CVE-2018-1000881 9.8 CriticalDecember 20, 2018