CVE-2026-27693: traccar allows XML injection in KML and GPX exports
Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX export functionality writes device names to XML output without proper escaping. An attacker with low privileges can create a device with a crafted name that injects XML content into exported files. If another user exports and opens the affected KML or GPX file, this can corrupt the file structure and spoof exported location data. This issue is fixed in version 6.13.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27693?
CVE-2026-27693 is categorized as a medium severity vulnerability due to the potential for XML injection in KML and GPX exports.
How do I fix CVE-2026-27693?
To fix CVE-2026-27693, upgrade Traccar to version 6.13.0 or later where XML output is properly escaped.
What versions of Traccar are affected by CVE-2026-27693?
CVE-2026-27693 affects all Traccar versions from 6.11.1 to 6.12.99.
What type of attack does CVE-2026-27693 enable?
CVE-2026-27693 enables low privilege attackers to exploit XML injection in the KML and GPX export functionality.
What is the impact of CVE-2026-27693 on users?
The impact of CVE-2026-27693 includes potential data manipulation and unauthorized information disclosure through crafted device names.