CVE-2006-3695

Trac < 0.9.6 - Arbitrary File Read and Cross-Site Scripting via reStructuredText Commands

Title source: llm
STIX 2.1

Description

Trac before 0.9.6 does not disable the "raw" or "include" commands when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows remote attackers to read arbitrary files, perform cross-site scripting (XSS) attacks, or cause a denial of service via unspecified vectors. NOTE: this might be related to CVE-2006-3458.

References (9)

Core 9
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/27706
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/2729
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/20958
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1016457
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/18323
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/27708
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2006/dsa-1152
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/21534
Third Party Advisory x_refsource_confirm
http://trac.edgewall.org/wiki/ChangeLog

Scores

EPSS 0.0186
EPSS Percentile 77.1%

Details

Status published
Products (2)
edgewall_software/trac < 0.9.5
pypi/trac 0 - 0.9.6PyPI
Published Jul 21, 2006
Tracked Since Feb 18, 2026