XML Injection Vulnerability in Traccar GPS Tracking System

CVE-2026-27693

What is CVE-2026-27693?

In Traccar, an open-source GPS tracking system, an XML injection vulnerability exists within the KML and GPX export functionality. Specifically, in versions 6.11.1 through 6.12.9, device names are written to the XML output without adequate escaping. This oversight permits low-privileged attackers to create devices with malicious names that inject XML content into exported files. When these compromised KML or GPX files are exported and subsequently opened by another user, the file structure may be corrupted or manipulated, leading to spoofed location data and significant integrity issues in the exported information. The vulnerability has been addressed in version 6.13.0.

References