CVE-2026-27694: traccar allows stored HTML injection in notification emails
Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the email notification templates insert user-controlled device, geofence, and driver names into HTML email output without proper escaping. An attacker with low privileges can store crafted HTML in these fields, which is then rendered in notification emails sent to other users with access to the affected devices. This can lead to phishing or spoofed email content. This issue is fixed in version 6.13.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27694?
CVE-2026-27694 is considered a moderate severity vulnerability due to the potential for stored HTML injection in email notifications.
How do I fix CVE-2026-27694?
You can fix CVE-2026-27694 by upgrading Traccar to version 6.13.0 or later, which addresses the HTML injection issue.
What versions of Traccar are affected by CVE-2026-27694?
CVE-2026-27694 affects Traccar versions from 6.11.1 to 6.12.x and is resolved in version 6.13.0.
What impact does CVE-2026-27694 have on users?
CVE-2026-27694 allows attackers to inject malicious HTML into email notifications, potentially leading to phishing or other malicious activities.
Is CVE-2026-27694 an open source vulnerability?
Yes, CVE-2026-27694 affects an open source software, specifically the Traccar GPS tracking system.