Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Trac 0.9.6 and earlier allows remote code execution

CVE-2006-3695 · published 20 years ago
Summary

Trac versions 0.9.6 and older have a security flaw that allows an attacker to access sensitive files or execute malicious code on your website, potentially causing harm to your users. To fix this, update Trac to version 0.9.6 or later.

What to do
  • Update edgewall software trac to version 0.9.6.
Affected software
Ecosystem VendorProductAffected versions
pip edgewall software trac < 0.9.6
Fix: upgrade to 0.9.6
– edgewall_software trac <= 0.9.5
cpe:2.3:a:edgewall_software:trac:*:*:*:*:*:*:*:*
Original advisory text
Trac before 0.9.6 does not disable the "raw" or "include" commands when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows remote attacker...
Trac before 0.9.6 does not disable the "raw" or "include" commands when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows remote attackers to read arbitrary files, perform cross-site scripting (XSS) attacks, or cause a denial of service via unspecified vectors. NOTE: this might be related to CVE-2006-3458.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.8 High
Exploitation
2% chance of attack within 30 days
Type
CWE-200Information Exposure
CWE-400Uncontrolled Resource Consumption
Timeline
Published21 Jul 2006
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-r524-c2gf-5chr · GHSA
CVE-2006-3695 · NVD
Track software like this
Free during beta