CVE-2026-27644: traccar allows CSV formula injection via exported position data
Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality writes position data, including user-controlled device and computed attributes, to CSV output without proper escaping. An attacker can inject spreadsheet formulas through exported fields. When a manager or administrator opens the exported CSV file in spreadsheet software, this can cause formula execution and lead to command execution or data exfiltration. This has been patched in version 6.13.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27644?
CVE-2026-27644 has been assessed as a medium severity vulnerability due to potential risks of CSV formula injection.
How do I fix CVE-2026-27644?
To fix CVE-2026-27644, upgrade Traccar to version 6.14.0 or later where the CSV export functionality is properly escaped.
Which versions of Traccar are affected by CVE-2026-27644?
CVE-2026-27644 affects Traccar versions between 6.11.1 and 6.13.0 inclusive.
What kind of vulnerability is CVE-2026-27644?
CVE-2026-27644 is a CSV formula injection vulnerability that allows user-controlled data to be exploited when exporting position data.
What are the potential impacts of CVE-2026-27644?
The potential impacts of CVE-2026-27644 include the execution of unintended commands or scripts when the exported CSV file is opened in spreadsheet applications.