HTML Injection Vulnerability in Traccar GPS Tracking System
CVE-2026-27694

5.4MEDIUM

Key Information:

Vendor

Traccar

Status
Traccar
Vendor
CVE Published:
5 May 2026

What is CVE-2026-27694?

Traccar, an open-source GPS tracking system, has a vulnerability in its email notification templates. Versions 6.11.1 to 6.12.9 inadvertently allow user-controlled input, such as device, geofence, and driver names, to be rendered in HTML email notifications without proper escaping. This oversight allows a low-privilege attacker to exploit these fields by crafting malicious HTML, leading to the potential for phishing attacks or spoofed email content. Users and administrators are advised to upgrade to version 6.13.0 to mitigate the associated risks. For further details, refer to the security advisory on GitHub.

Affected Version(s)

traccar >= 6.11.1, < 6.13.0

References

https://github.com/traccar/traccar/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.