CVE-2026-27693: fallo de gravedad media en traccar
traccar allows XML injection in KML and GPX exports
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.4epss 0.2%
Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX export functionality writes device names to XML output without proper escaping. An attacker with low privileges can create a device with a crafted name that injects XML content into exported files. If another user exports and opens the affected KML or GPX file, this can corrupt the file structure and spoof exported location data. This issue is fixed in version 6.13.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L
Productos afectados
traccar · traccarCVEs relacionadas — traccar
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-24809HIGHTraccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous TypeEPSS 54.4%CVE-2024-31214CRITICALTraccar's unrestricted file upload vulnerability in device image upload could lead to remote code executionEPSS 17.6%CVE-2025-61666HIGHTraccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config FileEPSS 1.3%CVE-2026-104203HIGHTraccar: Authentication bypass via path parameters exposes protected device mediaEPSS 0.8%CVE-2023-50729HIGHAn unrestricted file upload vulnerability in traccar leads to RCEEPSS 0.6%CVE-2025-68930HIGHTraccar Missing Origin Validation in WebSocketsEPSS 0.6%