CVE-2026-27644

Published: May 5, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Exploitability: 2.3 / Impact: 3.7

Source: security-advisories@github.com (Secondary)

Description

Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality writes position data, including user-controlled device and computed attributes, to CSV output without proper escaping. An attacker can inject spreadsheet formulas through exported fields. When a manager or administrator opens the exported CSV file in spreadsheet software, this can cause formula execution and lead to command execution or data exfiltration. This has been patched in version 6.13.0.

Affected (1)

Products: Traccar: Traccar

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Traccar Traccar	From 6.11.1 to 6.13.0

Related CWEs

Improper Neutralization of Formula Elements in a CSV File

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

References (3)

https://github.com/traccar/traccar/blob/v6.11.1/src/main/java/org/traccar/reports/CsvExportProvider.java#L89-L91

Source: security-advisories@github.com

Product

https://github.com/traccar/traccar/security/advisories/GHSA-745r-9qgj-x7m7

Source: security-advisories@github.com

ExploitMitigationVendor Advisory

https://github.com/traccar/traccar/security/advisories/GHSA-745r-9qgj-x7m7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitMitigationVendor Advisory

Timeline

No history available yet.