CVE-2026-27693

Katalog CVE

CVSS 5.4 · Medium EPSS 0,27%

Kerentanan XML Injection (aka Blind XPath Injection) pada traccar. Skor CVSS 3.1 5.4 (Medium) menurut github.com.

Deskripsi (NVD)

Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX export functionality writes device names to XML output without proper escaping. An attacker with low privileges can create a device with a crafted name that injects XML content into exported files. If another user exports and opens the affected KML or GPX file, this can corrupt the file structure and spoof exported location data. This issue is fixed in version 6.13.0.

Rincian

Terbit di NVD

5 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-91: XML Injection (aka Blind XPath Injection)

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 18,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/traccar/traccar/security/advisories/GHSA-32pj-vrqc-x656 exploit · mitigasi · advisory vendor
• https://github.com/traccar/traccar/blob/v6.11.0/src/main/java/org/traccar/reports/GpxExportProvider.java#L52-L... product