Back to Database
Status published
Medium
CVE-2021-21292
Unquoted Windows binary path in Traccar
Vulnerability Description
Traccar is an open source GPS tracking system. In Traccar before version 4.12 there is an unquoted Windows binary path vulnerability. Only Windows versions are impacted. Attacker needs write access to the filesystem on the host machine. If Java path includes a space, then attacker can lift their privilege to the same as Traccar service (system). This is fixed in version 4.12.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-21292
Credits & Attribution
No credits recorded in the NVD database.
References
More from traccar
View All →CVE-2025-68930
Traccar Missing Origin Validation in WebSockets
High
7.1
CVE-2025-61666
Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config File
High
8.7
CVE-2024-31214
Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution
Critical
9.7
CVE-2024-24809
Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type
High
8.5
CVE-2023-50729
An unrestricted file upload vulnerability in traccar leads to RCE
High
8.5
Affected Vendor
traccar
View all reports →Affected Software
traccar
Vulnerable Versions:
< 4.12
Timeline
Official Publish:
February 2nd, 2021
Last Modified:
August 3rd, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N