CVE-2026-104203

Name of the Vulnerable Software and Affected Versions Traccar versions 5.1 through 6.14.9

Description An issue exists where the MediaFilter Guice mapping in WebModule.java and the Jetty ResourceServlet in WebServer.java interpret path parameters differently at the '/api/media/*' endpoint. An unauthenticated attacker can bypass session and device authorization checks by inserting a semicolon at the Servlet boundary if they know or guess a device unique ID and media filename. This occurs because Jetty dispatches the noncanonical path to the ResourceServlet, allowing read-only disclosure of protected media files such as photographs, audio, or video. Reverse proxies that reject or rewrite semicolon path parameters may block these requests.

Recommendations Update to version 6.15.0. Use a reverse proxy that rejects or rewrites semicolon path parameters to block the request.