CVE-2026-27693

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-27693

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27693.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-27693

Aliases

GHSA-32pj-vrqc-x656

Published

2026-05-05T12:17:07.898Z

Modified

2026-07-15T01:49:02.427786294Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L CVSS Calculator

Summary

traccar allows XML injection in KML and GPX exports

Details

Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX export functionality writes device names to XML output without proper escaping. An attacker with low privileges can create a device with a crafted name that injects XML content into exported files. If another user exports and opens the affected KML or GPX file, this can corrupt the file structure and spoof exported location data. This issue is fixed in version 6.13.0.

Database specific

{
    "cwe_ids": [
        "CWE-91"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27693.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/traccar/traccar

Affected ranges

Type

GIT

Repo

https://github.com/traccar/traccar

Events

Introduced

f7a203cb000cd122c7dc0880538b75755fb2eab0

Fixed

811f746316ae9890eef39b08d8010cf3e8d5e687

Database specific

{
    "cpe": "cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "6.11.1"
        },
        {
            "fixed": "6.13.0"
        }
    ]
}

Affected versions

v6.*

v6.11.1

v6.12.0

v6.12.1

v6.12.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27693.json"