What is the CVSS score of CVE-2026-27644?

CVE-2026-27644 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-27644?

Yes, a patch is available for CVE-2026-27644. Update the affected software to the latest version immediately.

Traccar GPS Tracking CVE-2026-27644

EUVD-2026-27306 MEDIUM

Improper Neutralization of Formula Elements in a CSV File (CWE-1236)

2026-05-05 GitHub_M

Code Injection Traccar

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

May 05, 2026 - 14:01 EUVD

Analysis Generated

May 05, 2026 - 13:30 vuln.today

DescriptionGitHub Advisory

Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality writes position data, including user-controlled device and computed attributes, to CSV output without proper escaping. An attacker can inject spreadsheet formulas through exported fields. When a manager or administrator opens the exported CSV file in spreadsheet software, this can cause formula execution and lead to command execution or data exfiltration. This has been patched in version 6.13.0.

AnalysisAI

Traccar versions 6.11.1 through 6.13.0 fail to escape user-controlled device and computed attributes in CSV export functionality, allowing authenticated attackers to inject spreadsheet formulas that execute when a manager or administrator opens the exported file, potentially leading to command execution or data exfiltration. The vulnerability requires user interaction (opening the CSV) but affects all confidentiality, integrity, and availability once exploitation occurs. Patch available in version 6.13.0.

Technical ContextAI

The vulnerability exists in Traccar's CSV export provider (CsvExportProvider.java), which writes position data directly to CSV output without sanitizing formula injection characters. Spreadsheet applications like Microsoft Excel, Google Sheets, and LibreOffice interpret cells beginning with '=', '+', '-', or '@' as formulas, allowing attackers to craft malicious expressions through device names or custom attributes stored in the Traccar database. CWE-1236 (Improper Neutralization of Formula Elements in a CSV File) describes this class of flaw where untrusted data in spreadsheet-parseable formats can bypass input validation. The attack surface includes any CSV export endpoint that includes user-controllable fields (device names, attribute values) without escaping.

RemediationAI

Upgrade Traccar to version 6.13.0 or later to obtain the vendor-released patch that properly escapes formula characters in CSV output. Administrators running versions 6.11.1 through 6.13.0-rc should prioritize this upgrade as a security update. Until patching is complete, temporary compensating controls include: restrict CSV export functionality to administrators only (via Traccar role-based access controls), educate end users to disable formula evaluation warnings in spreadsheet software or configure spreadsheet applications to not auto-execute formulas on file open (though this is not a reliable mitigation), and monitor for suspicious CSV exports by reviewing audit logs for export activity. Restrict device naming and custom attribute input to alphanumeric characters and safe symbols (avoiding '=', '+', '-', '@') via input validation if backend changes are possible before upgrade.