CVE-2026-27644
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
May 5, 2026
CISA due date
—
The record
Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality writes position data, including user-controlled device and computed attributes, to CSV output without proper escaping. An attacker can inject spreadsheet formulas through exported fields. When a manager or administrator opens the exported CSV file in spreadsheet software, this can cause formula execution and lead to command execution or data exfiltration. This has been patched in version 6.13.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-89246 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV… CWE-1236
- CVE-2026-86257 wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV… CWE-1236
- CVE-2026-9852 A CSV injection vulnerability exists in SYS600. CWE-1236
- CVE-2026-56652 Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when… CWE-1236
- CVE-2026-19501 CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to… CWE-1236
- CVE-2026-64955 When Microsoft Excel imports a CSV file, it executes cells beginning with certain… CWE-1236
- CVE-2026-47705 TypeBot is a chatbot builder tool. CWE-1236
- CVE-2026-18738 Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that… CWE-1236