CVE-2026-104203: Traccar: Authentication bypass via path parameters exposes protected device media
Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's MediaFilter Guice mapping and WebServer.java's Jetty ResourceServlet assign different routing meanings to path parameters at /api/media/. An unauthenticated attacker who knows or guesses a device unique ID and media filename can insert a semicolon at the Servlet boundary, bypass MediaFilter's session and device authorization checks, and retrieve the protected media because Jetty still dispatches the noncanonical path to ResourceServlet. The demonstrated impact is read-only disclosure of a protected device media file; depending on the deployment and stored media, this could expose photographs, audio, video, or other uploaded files. The advisory does not establish directory listing, traversal, modification, account takeover, denial of service, or code execution. Reverse proxies that reject or rewrite semicolon path parameters may block the request. This issue is fixed in version 6.15.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Traccarto a version that resolves this vulnerability.Fixed in 6.15.0 - Compensating control
Configure a reverse proxy to reject or rewrite semicolon path parameters.
Event History
Frequently Asked Questions
Which deployments are exposed?
Traccar deployments from version 5.1 through versions before 6.15.0 are affected when protected device media is served through the vulnerable /api/media/* handling. A reverse proxy that rejects or rewrites semicolon path parameters may prevent the exploit request from reaching the application.
What does an attacker need to retrieve protected media?
The attacker needs no authentication, but must know or guess both a device unique ID and the target media filename. They exploit the routing mismatch by inserting a semicolon path parameter at the servlet boundary.
What data can be exposed?
The demonstrated impact is read-only retrieval of a protected device media file. Depending on what is stored, this may expose photographs, audio, video, or other uploaded files; the advisory does not establish listing, traversal, modification, account takeover, denial of service, or code execution.
What can be done if upgrading is not immediately possible?
Configure an upstream reverse proxy, where possible, to reject or rewrite requests containing semicolon path parameters before they reach Traccar. This is a mitigating control; upgrading to 6.15.0 is the stated fix.