Traccar
Traccar: vulnerabilidades y CVE
Traccar tiene 17 vulnerabilidades publicadas, 10 de ellas en los últimos 12 meses. 3 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE17
Últimos 12 meses10
Críticas3
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-52852 | Media (6.5) | 0.53% | — | 17 sept 2026 | Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hierarchy and request a trips or stops report… |
| CVE-2026-52851 | Alta (7.1) | 0.39% | — | 17 sept 2026 | Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra… |
| CVE-2026-44314 | Media (5.3) | 0.25% | — | 26 may 2026 | Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.Permission(User.class, getUserId(), Device.class) and then immediately… |
| CVE-2026-27694 | Media (5.4) | 0.24% | — | 5 may 2026 | Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the email notification templates insert user-controlled device, geofence, and driver names into HTML email… |
| CVE-2026-27693 | Media (5.4) | 0.27% | — | 5 may 2026 | Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX export functionality writes device names to XML output without proper escaping. An… |
| CVE-2026-27644 | Media (6.5) | 0.35% | — | 5 may 2026 | Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality writes position data, including user-controlled device and computed attributes, to CSV output without… |
| CVE-2026-25649 | Alta (8.7) | 0.18% | — | 23 feb 2026 | Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users can steal OAuth 2.0 authorization codes by exploiting an open redirect vulnerability in… |
| CVE-2026-25648 | Alta (8.7) | 0.39% | — | 23 feb 2026 | Versions of the Traccar open-source GPS tracking system starting with 6.11.1 contain an issue in which authenticated users can execute arbitrary JavaScript in the context of other users' browsers by uploading malicious… |
| CVE-2026-23521 | Media (6.5) | 0.33% | — | 23 feb 2026 | Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can create or edit devices can set a device `uniqueId` to an absolute path. When… |
| CVE-2025-68930 | Media (6.5) | 0.55% | — | 23 feb 2026 | Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the `/api/socket` endpoint. The application fails to validate the… |
| CVE-2025-61666 | Alta (8.7) | 1.3% | — | 2 oct 2025 | Traccar is an open source GPS tracking system. Default installs of Traccar on Windows between versions 6.1- 6.8.1 and non default installs between versions 5.8 - 6.0 are vulnerable to unauthenticated local file… |
| CVE-2024-7746 | Crítica (9.5) | 0.53% | — | 13 ago 2024 | Use of Default Credentials vulnerability in Tananaev Solutions Traccar Server on Administrator Panel modules allows Authentication Abuse.This issue affects the privileged transactions implemented by the Traccar solution… |
| CVE-2024-31214 | Crítica (9.6) | 18% | — | 10 abr 2024 | Traccar is an open source GPS tracking system. Traccar versions 5.1 through 5.12 allow arbitrary files to be uploaded through the device image upload API. Attackers have full control over the file contents, full control… |
| CVE-2024-24809 | Alta (8.5) | 54% | — | 10 abr 2024 | Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can… |
| CVE-2023-50729 | Crítica (9.8) | 0.60% | — | 15 ene 2024 | Traccar is an open source GPS tracking system. Prior to 5.11, Traccar is affected by an unrestricted file upload vulnerability in File feature allows attackers to execute arbitrary code on the server. This vulnerability… |
| CVE-2021-21292 | Media (6.3) | 0.39% | — | 2 feb 2021 | Traccar is an open source GPS tracking system. In Traccar before version 4.12 there is an unquoted Windows binary path vulnerability. Only Windows versions are impacted. Attacker needs write access to the filesystem on… |
| CVE-2020-5246 | Media (6.5) | 0.85% | — | 14 jul 2020 | Traccar GPS Tracking System before version 4.9 has a LDAP injection vulnerability. It occurs when user input is being used in LDAP search filter. By providing specially crafted input, an attacker can modify the logic of… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.