CVE-2021-21292: Unquoted Windows binary path in Traccar

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-02-02 · updated 2026-06-17
Weakness: CWE-428

Description

Traccar is an open source GPS tracking system. In Traccar before version 4.12 there is an unquoted Windows binary path vulnerability. Only Windows versions are impacted. Attacker needs write access to the filesystem on the host machine. If Java path includes a space, then attacker can lift their privilege to the same as Traccar service (system). This is fixed in version 4.12.

Affected products

Traccar: before 4.12 — fixed in 4.12

How to fix

Upgrade to a fixed version: Traccar 4.12. Check the vendor advisory for mitigations.

References

https://github.com/traccar/traccar/commit/cc69a9907ac9878db3750aa14ffedb28626455da
https://github.com/traccar/traccar/security/advisories/GHSA-j75r-7qm5-62q5
https://www.traccar.org/
https://github.com/traccar/traccar/commit/cc69a9907ac9878db3750aa14ffedb28626455da
https://github.com/traccar/traccar/security/advisories/GHSA-j75r-7qm5-62q5
https://www.traccar.org/

Get alerted when CVE-2021-21292 or the next vulnerability affects your stack