What’s Vulnerable › Vulnerabilities

CVE-2026-27693: traccar allows XML injection in KML and GPX exports

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-05-05 · updated 2026-06-17
• Weakness: CWE-91

Description

Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX export functionality writes device names to XML output without proper escaping. An attacker with low privileges can create a device with a crafted name that injects XML content into exported files. If another user exports and opens the affected KML or GPX file, this can corrupt the file structure and spoof exported location data. This issue is fixed in version 6.13.0.

Affected products

• Traccar: from 6.11.1 before 6.13.0 — fixed in 6.13.0

How to fix

Upgrade to a fixed version: Traccar 6.13.0. Check the vendor advisory for mitigations.

References

• https://github.com/traccar/traccar/blob/v6.11.0/src/main/java/org/traccar/reports/GpxExportProvider.java#L52-L54
• https://github.com/traccar/traccar/security/advisories/GHSA-32pj-vrqc-x656
• https://github.com/traccar/traccar/security/advisories/GHSA-32pj-vrqc-x656

Get alerted when CVE-2026-27693 or the next vulnerability affects your stack