What is the CVSS score of EUVD-2026-27309?

EUVD-2026-27309 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-27309?

Yes, a patch is available for EUVD-2026-27309. Update the affected software to the latest version immediately.

Traccar EUVD-2026-27309

| CVE-2026-27694 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-05 GitHub_M

XSS Traccar

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

May 05, 2026 - 14:01 EUVD

Analysis Generated

May 05, 2026 - 13:30 vuln.today

DescriptionGitHub Advisory

Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the email notification templates insert user-controlled device, geofence, and driver names into HTML email output without proper escaping. An attacker with low privileges can store crafted HTML in these fields, which is then rendered in notification emails sent to other users with access to the affected devices. This can lead to phishing or spoofed email content. This issue is fixed in version 6.13.0.

AnalysisAI

Stored cross-site scripting (XSS) in Traccar 6.11.1 through 6.12.x allows low-privilege authenticated users to inject malicious HTML into device, geofence, and driver name fields, which is then rendered unescaped in email notification templates sent to other users. This enables phishing attacks or spoofed email content delivered via the application's notification system. The vulnerability is fixed in version 6.13.0.

Technical ContextAI

Traccar's email notification system dynamically constructs HTML email bodies by interpolating user-controlled data (device names, geofence names, driver names) into email templates without HTML entity encoding or sanitization. The vulnerability is rooted in CWE-79 (Cross-site Scripting), specifically improper output encoding in a server-side templating context. Unlike traditional reflected XSS, this is stored XSS-the malicious payload persists in the database and is executed in the context of email clients (or HTML-capable email readers) every time a notification is generated and sent. The affected product is org.traccar:traccar (Java/Maven artifact), impacting the open-source GPS tracking platform.

RemediationAI

Upgrade Traccar to version 6.13.0 or later immediately, as this version includes fixes for HTML escaping in email notification templates. Obtain the patched version from the official Traccar repository (https://github.com/traccar/traccar/security/advisories/GHSA-6hfr-mj4m-hrvv). If immediate upgrade is not feasible, restrict object creation and editing permissions: limit low-privilege users' ability to modify device names, geofence names, and driver names to only trusted administrators. This reduces the attack surface by preventing unprivileged users from injecting malicious HTML into fields that populate notification emails. Additionally, configure email client security policies to disable HTML rendering or block external resources in emails from Traccar, though this is a defense-in-depth measure and not a primary mitigation. Monitor email audit logs for unusual device, geofence, or driver name changes that contain HTML or special characters (< > " '), which may indicate exploitation attempts.