CVE-2026-27644CWE-1236

traccar allows CSV formula injection via exported position data

Medium · published May 5, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
27.9
In the wild
Unconfirmed
What it is

Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality writes position data, including user-controlled device and computed attributes, to CSV output without proper escaping. An attacker can inject spreadsheet formulas through exported fields. When a manager or administrator opens the exported CSV file in spreadsheet software, this can cause formula execution and lead to command execution or data exfiltration. This has been patched in version 6.13.0.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00354 · 27.9th percentile
Weakness
CWE-1236 · Improper Neutralization of Formula Elements in a CSV File
Published
2026-05-05T12:12Z
EPSS history
Timeline
  • 05 MAY 12:12Z
    traccar allows CSV formula injection via exported position data
    cvelistv5