CVE-2026-27694CWE-79

traccar allows stored HTML injection in notification emails

Medium · published May 5, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
14.1
In the wild
Unconfirmed
What it is

Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the email notification templates insert user-controlled device, geofence, and driver names into HTML email output without proper escaping. An attacker with low privileges can store crafted HTML in these fields, which is then rendered in notification emails sent to other users with access to the affected devices. This can lead to phishing or spoofed email content. This issue is fixed in version 6.13.0.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00239 · 14.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-05-05T12:20Z
EPSS history
Timeline
  • 05 MAY 12:20Z
    traccar allows stored HTML injection in notification emails
    cvelistv5