PT-2026-37032

CVE-2026-27644

Published

2026-05-05

Updated

2026-05-08

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Traccar versions 6.11.1 through 6.12.x

Description The CSV export functionality writes position data, including user-controlled device and computed attributes, to CSV output without proper escaping. This allows an attacker to inject spreadsheet formulas through exported fields. If a manager or administrator opens the resulting CSV file in spreadsheet software, it can trigger formula execution, potentially leading to command execution or data exfiltration.

Recommendations Update to version 6.13.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Djvirus9

Vendors

Affected products

Weakness enumeration

CWE-1236: Improper Neutralization of Formula Elements in a CSV File

Related identifiers