Traccar, an open source GPS tracking system, has an issue where email notification templates embed unescaped user‑controlled data such as device, geofence, and driver names into HTML output. Attackers with low privileges can insert crafted HTML into these fields. When notification emails are generated for other users who can access the affected devices, the malicious HTML is rendered in the email body. This flaw aligns with CWE‑79: Improper Neutralization of Input During Web Page Generation.

The vulnerability affects Traccar versions starting at 6.11.1 through 6.12.x; the fix is included in version 6.13.0 and later.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score is not available. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would exploit the web interface or API to inject malicious HTML into device or driver name fields, which is then sent out in normal notification emails to users with access rights. The impact is primarily phishing or spoofed content delivered via email, affecting confidentiality and user trust rather than direct system compromise.