PT-2026-37032 · Traccar · Traccar

Djvirus9 · Published 2026-05-05 · Updated 2026-05-08 · CVE-2026-27644

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Traccar versions 6.11.1 through 6.12.x

Description The CSV export functionality writes position data, including user-controlled device and computed attributes, to CSV output without proper escaping. This allows an attacker to inject spreadsheet formulas through exported fields. If a manager or administrator opens the resulting CSV file in spreadsheet software, it can trigger formula execution, potentially leading to command execution or data exfiltration.

Recommendations Update to version 6.13.0.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2026-27644

Affected Products

Traccar

References · 6

• 🔥 https://github.com/traccar/traccar/security/advisories/GHSA-745r-9qgj-x7m7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-27644 · Security Note
• https://github.com/traccar/traccar/blob/v6.11.1/src/main/java/org/traccar/reports/CsvExportProvider.java#L89-L91 · Note
• https://t.me/CVEtracker/52747 · Telegram Post
• https://t.me/cveNotify/162173 · Telegram Post
• https://t.me/cveNotify/162786 · Telegram Post