CVE-2026-27644

Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality writes position data, including user-controlled device and computed attributes, to CSV output without proper escaping. An attacker can inject spreadsheet formulas through exported fields. When a manager or administrator opens the exported CSV file in spreadsheet software, this can cause formula execution and lead to command execution or data exfiltration. This has been patched in version 6.13.0.

• CWE-1236

• https://github.com/traccar/traccar/blob/v6.11.1/src/main/java/org/traccar/reports/CsvExportProvider.java#L89-L91Product
• https://github.com/traccar/traccar/security/advisories/GHSA-745r-9qgj-x7m7Exploit, Mitigation, Vendor Advisory
• https://github.com/traccar/traccar/security/advisories/GHSA-745r-9qgj-x7m7Exploit, Mitigation, Vendor Advisory

Published

May 5, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27639Mercator is an open source web application designed to enabl…5.4
• CVE-2026-2764JIT miscompilation, use-after-free in the JavaScript Engine:…9.8
• CVE-2026-27640tfplan2md is software for converting Terraform plan JSON fil…7.5
• CVE-2026-27641Flask-Reuploaded provides file uploads for Flask. A critical…9.8
• CVE-2026-27642free5gc UDM provides Unified Data Management (UDM) for free5…7.5
• CVE-2026-27643free5GC UDR is the user data repository (UDR) for free5GC, a…5.3
• CVE-2026-27645changedetection.io is a free open source web page change det…6.1
• CVE-2026-27646OpenClaw versions prior to 2026.3.7 contain a sandbox escape…6.1
• CVE-2026-27647The WebSocket backend uses charging station identifiers to u…9.8
• CVE-2026-27648in OpenHarmony v6.0 and prior versions allow a remote attack…8.8
• CVE-2026-27649The WebSocket backend uses charging station identifiers to u…6.5
• CVE-2026-2765Use-after-free in the JavaScript Engine component. This vuln…9.8