Vulnerability in Traccar
CVE-2026-27644
Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality writes position data, including user-controlled device and computed attributes, to CSV output without proper escaping. An attacker can inject spreadsheet formulas through exported fields. When a manager or administrator opens the exported CSV file in spreadsheet software, this can cause formula execution and lead to command execution or data exfiltration. This has been patched in version 6.13.0.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.004 (26.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 27th percentile — 26.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.004 · change: +0.001
Affected products
- Traccar — versions >= 6.11.1 , < 6.13.0
Weakness classification (CWE)
References
- github.com/traccar/traccar/blob/v6.11.1/src/main/java/org/traccar/reports/CsvEx… (Product)
- github.com/traccar/traccar/security/advisories/GHSA-745r-9qgj-x7m7 (Exploit, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-27644?
- CVE-2026-27644 is a medium-severity vulnerability in Traccar, classified under Improper Neutralization of Formula Elements in a CSV File. CVSS score: 6.5/10. Published 2026-05-05.
- How severe is CVE-2026-27644?
- Medium severity. CVSS v3 base score is 6.5 out of 10.