CVE-2026-104203 in Traccar
Summary
by MITRE • 11/04/2026
Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's MediaFilter Guice mapping and WebServer.java's Jetty ResourceServlet assign different routing meanings to path parameters at /api/media/*. An unauthenticated attacker who knows or guesses a device unique ID and media filename can insert a semicolon at the Servlet boundary, bypass MediaFilter's session and device authorization checks, and retrieve the protected media because Jetty still dispatches the noncanonical path to ResourceServlet. The demonstrated impact is read-only disclosure of a protected device media file; depending on the deployment and stored media, this could expose photographs, audio, video, or other uploaded files. The advisory does not establish directory listing, traversal, modification, account takeover, denial of service, or code execution. Reverse proxies that reject or rewrite semicolon path parameters may block the request. This issue is fixed in version 6.15.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
Traccar serves as a widely deployed open-source GPS tracking system designed to monitor vehicle and asset locations through connected devices. Within versions ranging from 5.1 up to 6.15.0, the application architecture exhibits a critical path traversal vulnerability stemming from inconsistent handling of URL path parameters by its internal web server components. The core issue resides in the interaction between WebModule.java's MediaFilter and WebServer.java's Jetty ResourceServlet when processing requests directed at the /api/media/ endpoint. This architectural flaw creates an authorization bypass that allows unauthenticated actors to access sensitive data, fundamentally undermining the security model intended for protected media files associated with specific tracking devices.
The technical mechanism of this vulnerability relies on a discrepancy in how path parameters are interpreted across different layers of the application stack. The MediaFilter is responsible for enforcing session validity and verifying device authorization before allowing access to restricted resources. However, Jetty's ResourceServlet processes incoming HTTP requests using non-canonical path resolution rules that differ from those applied by the Java-based filter logic. Specifically, when an attacker inserts a semicolon character into the URL path parameter immediately following the resource identifier, the MediaFilter fails to recognize this as part of the intended file path due to its parsing implementation. Consequently, the authorization checks are effectively skipped because the filter does not see the full maliciously crafted path.
Despite bypassing the application-level security controls, Jetty continues to dispatch the request to the ResourceServlet using the original non-canonical path containing the semicolon. The servlet engine interprets this path correctly and locates the requested file on the server's filesystem. This divergence in behavior between the filtering layer and the serving layer creates a blind spot that attackers can exploit. By knowing or guessing a valid device unique ID and media filename, an unauthenticated attacker can construct URLs with embedded semicolons to retrieve protected content without providing any credentials or authentication tokens.
The operational impact of this vulnerability is primarily read-only disclosure of sensitive information stored on the Traccar server. Depending on the specific deployment configuration and the types of data collected by the tracked devices, attackers may gain access to photographs, audio recordings, video footage, or other uploaded media files associated with target assets. This exposure poses significant privacy risks for individuals whose locations are being monitored and can lead to unauthorized surveillance if sensitive visual or auditory evidence is compromised. The advisory explicitly clarifies that this flaw does not facilitate directory listing, path traversal beyond the intended scope, file modification, account takeover, denial of service conditions, or remote code execution, limiting the impact strictly to information disclosure.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-601 URL Redirection to Untrusted Destination if interpreted broadly as path manipulation, though it is most accurately described under CWE-798 Use of Hard-coded Credentials or more specifically CWE-352 Cross-Site Request Forgery mechanisms are not applicable here; rather it fits CWE-434 Unrestricted Upload of File with Dangerous Type in terms of impact but technically represents an Authorization Bypass through Path Manipulation. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1078 Valid Accounts if authentication was bypassed via other means, but since it is unauthenticated access due to a logic flaw, it maps more closely to T1530 Data from Cloud Storage or general data exfiltration techniques where unauthorized actors retrieve stored information. The root cause is classified as an improper input validation and path normalization issue within the web server integration layer.
Mitigation strategies for this vulnerability involve both immediate operational fixes and long-term architectural improvements. Administrators running affected versions must upgrade to Traccar version 6.15.0 or later, where the developers have corrected the routing logic to ensure consistent path interpretation across all components. For environments unable to patch immediately, deploying a reverse proxy such as Nginx or Apache HTTP Server in front of the application can provide an effective defense layer. These proxies should be configured to reject or rewrite URL paths containing semicolon characters before they reach the Traccar backend, thereby neutralizing the attack vector at the network perimeter. Additionally, organizations should review their access control policies and consider implementing strict input validation on all path parameters to prevent similar logic flaws in future updates.