Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX export functionality writes device names to XML output without proper escaping. An attacker with low privileges can create a device with a crafted name that injects XML content into exported files. If another user exports and opens the affected KML or GPX file, this can corrupt the file structure and spoof exported location data. This issue is fixed in version 6.13.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-27693 Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX export functionality writes device na… https://www.cve.org/CVERecord?id=CVE-2026-27693
Post summary
The post announces a new CVE for Traccar’s KML/GPX export feature in specific versions, providing only basic technical details without mentioning PoC, exploit, or patch information.
🚨*CVE* CVE-2026-27693 Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX export functionality writes device na… https://www.cve.org/CVERecord?id=CVE-2026-27693 ----- Traducción: CVE-2026-27693 Tra… http://infoflow.cloud`
Post summary
The text announces CVE-2026-27693 for Traccar’s KML/GPX export feature but provides no proof of concept, exploit, or mitigation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | traccar | traccar | - | - | - |