CVE-2026-27644: fallo de gravedad media en traccar
traccar allows CSV formula injection via exported position data
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.2%
Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality writes position data, including user-controlled device and computed attributes, to CSV output without proper escaping. An attacker can inject spreadsheet formulas through exported fields. When a manager or administrator opens the exported CSV file in spreadsheet software, this can cause formula execution and lead to command execution or data exfiltration. This has been patched in version 6.13.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Productos afectados
traccar · traccarCVEs relacionadas — traccar
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-24809HIGHTraccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous TypeEPSS 54.4%CVE-2024-31214CRITICALTraccar's unrestricted file upload vulnerability in device image upload could lead to remote code executionEPSS 17.6%CVE-2025-61666HIGHTraccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config FileEPSS 1.3%CVE-2026-104203HIGHTraccar: Authentication bypass via path parameters exposes protected device mediaEPSS 0.8%CVE-2023-50729HIGHAn unrestricted file upload vulnerability in traccar leads to RCEEPSS 0.6%CVE-2025-68930HIGHTraccar Missing Origin Validation in WebSocketsEPSS 0.6%