Skip to content
OpenAdvisories
Critical DSA-1152 1 CVE

trac - missing input sanitising

Published Aug 18, 2006 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 3.1 trac 0.8.1-3sarge5

Vulnerabilities 1

  • Critical 9.4
    CVE-2006-3695

    Trac reStructuredText breach of privacy and denial of service vulnerability

    Trac before 0.9.6 does not disable the "raw" or "include" commands when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows remote attackers to read arbitrary files, perform cross-site scripting (XSS) …

    trac trac Debian PyPI