CVE-2026-27644 — Traccar is an open source GPS tracking system. In versions

title: Traccar CSV Export Formula Injection Attempt - CVE-2026-27644
id: scw-2026-05-05-ai-1
status: experimental
level: high
description: |
  Detects attempts to exploit Traccar CVE-2026-27644 by requesting a CSV export with parameters that suggest the injection of spreadsheet formulas. The vulnerability allows attackers to inject formulas into exported fields, which can lead to command execution when opened in spreadsheet software. This rule specifically looks for the CSV export endpoint with suspicious characters often used in formula injection within the URI query parameters.
author: SCW Feed Engine (AI-generated)
date: 2026-05-05
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-27644/
tags:
  - attack.execution
  - attack.t1559.002
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/api/reports/export'
      cs-method|exact:
          - 'GET'
      cs-uri-query|contains:
          - 'format=csv'
      sc-status|exact:
          - '200'
  selection_indicators:
      uri|contains:
          - '=
      uri|contains:
          - '+
      uri|contains:
          - '-'
      uri|contains:
          - '@'
  condition: selection AND selection_indicators
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse