CVE-2026-104203— Traccar: Authentication bypass via path parameters exposes protected device media

Quick assessment

Affected

traccar traccar

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Traccar 是一个开源的 GPS 追踪系统。在 5.1 至 6.15.0 版本中，WebModule.java 的 MediaFilter Guice 映射与 WebServer.java 的 Jetty ResourceServlet 对路径参数赋予了不同的路由含义。未认证的攻击者若知晓或猜解到设备的唯一标识符（ID）及媒体文件名，可在 Servlet 边界处插入分号（），从而绕过 MediaFilter 的会话与设备授权检查，并获取受保护的媒体文件；这是因为 Jetty 仍会将该非规范路径分发至 Res

CVSS 7.5 · High Updated Nov 05, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Traccar: Authentication bypass via path parameters exposes protected device media

Source: CVE Program / CVE List V5

Vulnerability Description

Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's MediaFilter Guice mapping and WebServer.java's Jetty ResourceServlet assign different routing meanings to path parameters at /api/media/*. An unauthenticated attacker who knows or guesses a device unique ID and media filename can insert a semicolon at the Servlet boundary, bypass MediaFilter's session and device authorization checks, and retrieve the protected media because Jetty still dispatches the noncanonical path to ResourceServlet. The demonstrated impact is read-only disclosure of a protected device media file; depending on the deployment and stored media, this could expose photographs, audio, video, or other uploaded files. The advisory does not establish directory listing, traversal, modification, account takeover, denial of service, or code execution. Reverse proxies that reject or rewrite semicolon path parameters may block the request. This issue is fixed in version 6.15.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

信息暴露

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
traccar	traccar	>= 5.1, < 6.15.0	-

II. Public POCs for CVE-2026-104203

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-104203

请登录查看更多情报信息。

Other References for CVE-2026-104203 (3)

https://github.com/traccar/traccar/releases/tag/v6.15.0 x_refsource_MISC
https://github.com/traccar/traccar/security/advisories/GHSA-w59q-j9pg-pw7x x_refsource_CONFIRM
https://github.com/traccar/traccar/commit/f6f22ea32a7c6d51f2cdc923cca6d3b2621a205a x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-104203

IV. Related Vulnerabilities

Same product: traccar

Same vendor: traccar

Same weakness: CWE-200