CVE-2026-27694

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27694", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-23T17:56:51.202Z", "datePublished": "2026-05-05T12:20:55.174Z", "dateUpdated": "2026-05-05T14:12:04.800Z"}, "containers": {"cna": {"title": "traccar allows stored HTML injection in notification emails", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/traccar/traccar/security/advisories/GHSA-6hfr-mj4m-hrvv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/traccar/traccar/security/advisories/GHSA-6hfr-mj4m-hrvv"}], "affected": [{"vendor": "traccar", "product": "traccar", "versions": [{"version": ">= 6.11.1, < 6.13.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-05T12:20:55.174Z"}, "descriptions": [{"lang": "en", "value": "Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the email notification templates insert user-controlled device, geofence, and driver names into HTML email output without proper escaping. An attacker with low privileges can store crafted HTML in these fields, which is then rendered in notification emails sent to other users with access to the affected devices. This can lead to phishing or spoofed email content. This issue is fixed in version 6.13.0."}], "source": {"advisory": "GHSA-6hfr-mj4m-hrvv", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/traccar/traccar/security/advisories/GHSA-6hfr-mj4m-hrvv", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-05T13:58:18.200849Z", "id": "CVE-2026-27694", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-05T14:12:04.800Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27694", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-05T13:58:18.200849Z"}}}], "references": [{"url": "https://github.com/traccar/traccar/security/advisories/GHSA-6hfr-mj4m-hrvv", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-05T13:59:18.106Z"}}], "cna": {"title": "traccar allows stored HTML injection in notification emails", "source": {"advisory": "GHSA-6hfr-mj4m-hrvv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "traccar", "product": "traccar", "versions": [{"status": "affected", "version": ">= 6.11.1, < 6.13.0"}]}], "references": [{"url": "https://github.com/traccar/traccar/security/advisories/GHSA-6hfr-mj4m-hrvv", "name": "https://github.com/traccar/traccar/security/advisories/GHSA-6hfr-mj4m-hrvv", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the email notification templates insert user-controlled device, geofence, and driver names into HTML email output without proper escaping. An attacker with low privileges can store crafted HTML in these fields, which is then rendered in notification emails sent to other users with access to the affected devices. This can lead to phishing or spoofed email content. This issue is fixed in version 6.13.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-05T12:20:55.174Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27694", "state": "PUBLISHED", "dateUpdated": "2026-05-05T14:12:04.800Z", "dateReserved": "2026-02-23T17:56:51.202Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-05T12:20:55.174Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "traccar", "vendor": "traccar", "versions": [{"status": "affected", "version": ">= 6.11.1, < 6.13.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*", "matchCriteriaId": "A453268E-69E6-4CE2-A341-8890520DF28E", "versionEndExcluding": "6.13.0", "versionStartIncluding": "6.11.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the email notification templates insert user-controlled device, geofence, and driver names into HTML email output without proper escaping. An attacker with low privileges can store crafted HTML in these fields, which is then rendered in notification emails sent to other users with access to the affected devices. This can lead to phishing or spoofed email content. This issue is fixed in version 6.13.0."}, {"lang": "es", "value": "Traccar es un sistema de seguimiento GPS de c\u00f3digo abierto. En las versiones de org.traccar:traccar a partir de la 6.11.1 y anteriores a la 6.13.0, las plantillas de notificaci\u00f3n por correo electr\u00f3nico insertan nombres de dispositivos, geocercas y conductores controlados por el usuario en la salida de correo electr\u00f3nico HTML sin el escape adecuado. Un atacante con privilegios bajos puede almacenar HTML manipulado en estos campos, que luego se renderiza en los correos electr\u00f3nicos de notificaci\u00f3n enviados a otros usuarios con acceso a los dispositivos afectados. Esto puede llevar a phishing o contenido de correo electr\u00f3nico falsificado. Este problema se solucion\u00f3 en la versi\u00f3n 6.13.0."}], "id": "CVE-2026-27694", "lastModified": "2026-11-11T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27694", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-05T13:58:18.200849Z", "version": "2.0.3"}}]}, "published": "2026-05-05T13:16:28.513", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/traccar/traccar/security/advisories/GHSA-6hfr-mj4m-hrvv"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/traccar/traccar/security/advisories/GHSA-6hfr-mj4m-hrvv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.11.1,6.13.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "traccar", "source": "cna", "vendor": "traccar"}, "product": "traccar", "vendor": "traccar"}], "created": "2026-05-05T13:30:24.946502+00:00", "updated": "2026-05-05T13:30:25.250684+00:00", "vendors": ["traccar", "traccar$PRODUCT$traccar"]}