PT-2026-37033 · Traccar · Traccar

Djvirus9 · Published 2026-05-05 · Updated 2026-05-05 · CVE-2026-27693

Mitre

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L

Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX export functionality writes device names to XML output without proper escaping. An attacker with low privileges can create a device with a crafted name that injects XML content into exported files. If another user exports and opens the affected KML or GPX file, this can corrupt the file structure and spoof exported location data. This issue is fixed in version 6.13.0.

Fix

Weakness Enumeration

CWE-91

Related Identifiers

CVE-2026-27693

Affected Products

Traccar

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-27693 · Security Note
• https://github.com/traccar/traccar/blob/v6.11.0/src/main/java/org/traccar/reports/GpxExportProvider.java#L52-L54 · Note
• https://github.com/traccar/traccar/security/advisories/GHSA-32pj-vrqc-x656 · Note