CVE-2026-27644

Katalog CVE

CVSS 6.5 · Medium EPSS 0,35%

Kerentanan Improper Neutralization of Formula Elements in a CSV File pada traccar. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality writes position data, including user-controlled device and computed attributes, to CSV output without proper escaping. An attacker can inject spreadsheet formulas through exported fields. When a manager or administrator opens the exported CSV file in spreadsheet software, this can cause formula execution and lead to command execution or data exfiltration. This has been patched in version 6.13.0.

Rincian

Terbit di NVD

5 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1236: Improper Neutralization of Formula Elements in a CSV File

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 27,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/traccar/traccar/security/advisories/GHSA-745r-9qgj-x7m7 exploit · mitigasi · advisory vendor
• https://github.com/traccar/traccar/blob/v6.11.1/src/main/java/org/traccar/reports/CsvExportProvider.java#L89-L... product