CVE-2004-1444: Roundup Directory Traversal Vulnerability
Summary
CVE-2004-1444: Roundup Directory traversal vulnerability. Affects roundup versions < 0.7.3. Fixed in 0.7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Roundup is a package available on PyPI that provides a simple and flexible issue-tracking system. It allows users to create and manage issues, track progress, and collaborate on projects. The vulnerability in Roundup versions 0.6.4 and earlier allows remote attackers to view arbitrary files by exploiting a directory traversal vulnerability. This vulnerability can be triggered by using .. (dot dot) sequences in an @@ command in an HTTP GET request.
Vulnerability Detail
The directory traversal vulnerability in Roundup allows an attacker to bypass access restrictions and view arbitrary files on the server. By including .. sequences in the @@ command of an HTTP GET request, an attacker can traverse directories and access files outside the intended scope. This can lead to the exposure of sensitive information, such as configuration files, user data, or other confidential data stored on the server. The impact of this vulnerability depends on the specific files that can be accessed and the sensitivity of the information contained within them.
How To Fix
Latest published version: 2.6.0 as of 22 Oct 2026
pip install --upgrade "roundup==2.6.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.7.3
This is the first release that contains the fix.
pip install --upgrade "roundup==0.7.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a fixed version is not immediately possible, a temporary workaround is to implement input validation and sanitization on the server-side. This can involve checking user input for any .. sequences and blocking or removing them before processing the request. Additionally, access controls and permissions should be properly configured to limit the exposure of sensitive files. It is important to note that workarounds may not provide complete protection and upgrading to a fixed version is still the recommended solution.
Conclusion
The directory traversal vulnerability in Roundup versions 0.6.4 and earlier allows remote attackers to view arbitrary files on the server. It is crucial to upgrade to a fixed version of Roundup, preferably the latest version, to mitigate this vulnerability. Implementing input validation and sanitization as a temporary workaround can provide some protection, but it is not a substitute for upgrading. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for roundup →
FAQ
The vulnerability allows remote attackers to view arbitrary files on the server, potentially exposing sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, a temporary workaround is to implement input validation and sanitization on the server-side to block or remove any .. sequences in the request. However, upgrading to a fixed version is still recommended.
Roundup versions 0.6.4 and earlier are affected by this vulnerability.
Yes, the vulnerability has been fixed in Roundup version 0.7.3 and later. It is recommended to upgrade to the latest version to ensure the vulnerability is patched.
Related vulnerabilities
Recent vulnerabilities recorded for roundup.
