The vulnerability arises when the CSV export provider writes position data to a CSV file without escaping user‑controlled fields. This allows an attacker to embed spreadsheet formulas such as =CMD|… into fields that appear in exported files. When a system administrator or manager opens the file in common spreadsheet software, the formula is evaluated, potentially triggering abnormal execution or data exfiltration. The flaw thus enables the attacker to run arbitrary code or exfiltrate data from the environment.

The issue affects the Traccar GPS tracking platform, specifically versions 6.11.1 through 6.13.0. The vulnerable functionality resides in the CsvExportProvider component of the server. Any installation of Traccar within that version range that utilizes the CSV export feature is susceptible. Versions 6.13.0 and later contain the remedial patch and are not affected.

The CVSS score of 6.5 indicates a moderate severity. No EPSS score is reported and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation is currently known. However, the attack requires an attacker to supply data that will be exported and a victim to open the file, meaning the vector is limited but still significant for environments where privileged users frequently process exported data. Because the risk remains actionable, administrators should not delay remediation.