CVE-2026-27694

MEDIUM

5.4

Description

Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the email notification templates insert user-controlled device, geofence, and driver names into HTML email output without proper escaping. An attacker with low privileges can store crafted HTML in these fields, which is then rendered in notification emails sent to other users with access to the affected devices. This can lead to phishing or spoofed email content. This issue is fixed in version 6.13.0.

Details CVE

Score CVSS v3.15.4

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisLOW

Interaction utilisateurREQUIRED

Publie5/5/2026

Derniere modification5/5/2026

Sourcenvd

Observations honeypot0

Faiblesses (CWE)

CWE-79

References

https://github.com/traccar/traccar/security/advisories/GHSA-6hfr-mj4m-hrvv(security-advisories@github.com)

https://github.com/traccar/traccar/security/advisories/GHSA-6hfr-mj4m-hrvv(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.