Traccar’s KML and GPX export features output device names straight into XML documents without proper escaping. A user who can create a device can supply a name that injects arbitrary XML markup. When another user later exports a KML or GPX file containing the injected XML, the output structure can be corrupted or the displayed location data can be spoofed. This weakness is a classic XML injection (CWE-91) and does not provide remote code execution, but it does allow data tampering and potential denial of service for GPS exports.

The vulnerability exists in Traccar versions 6.11.1 through 6.12.x; users of the open‑source GPS tracking system who are running any of those builds are affected.

The CVSS score of 5.4 indicates a moderate severity. No EPSS score is available, but the attacker only needs the ability to create a device and to export the file, both of which require authenticated access. The issue is not listed in CISA’s KEV catalog, and the attack vector is local rather than network exposed. Overall risk is moderate, and the resolution is to apply the available patch.