CVE-2007-1405: Cross-Site Scripting (XSS) in Trac
Summary
CVE-2007-1405: Cross-site scripting (XSS) vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via u... Affects trac versions < 0.10.3.1. Fixed in 0.10.3.1. How to fix ↓
Also tracked for
- trac · Debian:13
The same CVE-2007-1405 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Trac is an open-source project management and issue tracking system written in Python. It provides a web-based interface for managing software development projects. Trac allows users to create and edit wiki pages, which can be downloaded as text files. However, prior to version 0.10.3.1, Trac is vulnerable to a cross-site scripting (XSS) attack when using Microsoft Internet Explorer. This vulnerability allows remote attackers to inject arbitrary web script or HTML through unspecified parameters.
Vulnerability Detail
The cross-site scripting (XSS) vulnerability in Trac allows attackers to inject malicious code into the application, which can be executed by unsuspecting users. By exploiting this vulnerability, an attacker can steal sensitive information, such as login credentials, or perform actions on behalf of the user. The vulnerability specifically affects the "download wiki page as text" feature in Trac when accessed using Microsoft Internet Explorer.
How To Fix
Latest published version: 1.6.0 as of 22 Oct 2026
pip install --upgrade "trac==1.6.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.10.3.1
This is the first release that contains the fix.
pip install --upgrade "trac==0.10.3.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Trac is not immediately possible, users can mitigate the risk by avoiding the use of Microsoft Internet Explorer when accessing the "download wiki page as text" feature. Instead, they can use alternative web browsers that are not affected by this vulnerability, such as Mozilla Firefox or Google Chrome.
Conclusion
The cross-site scripting (XSS) vulnerability in Trac allows remote attackers to inject malicious code into the application, potentially leading to unauthorized actions or data theft. It is crucial to upgrade Trac to version 0.10.3.1 or later to fix this vulnerability. If immediate upgrade is not possible, users should avoid using Microsoft Internet Explorer when accessing the affected feature. Using alternative web browsers, such as Mozilla Firefox or Google Chrome, can mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for trac →
FAQ
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can be used to steal sensitive information, manipulate web content, or perform unauthorized actions on behalf of the user.
The XSS vulnerability in Trac allows remote attackers to inject arbitrary web script or HTML into the application. This can lead to various consequences, such as stealing user credentials, modifying content, or performing actions on behalf of the user.
The vulnerability affects Trac versions prior to 0.10.3.1. Users of these versions should upgrade to the latest version to mitigate the risk.
If immediate upgrade is not possible, users can use alternative web browsers, such as Mozilla Firefox or Google Chrome, to access the affected feature in Trac. These browsers are not vulnerable to the XSS attack.
For more information about this vulnerability, you can refer to the official Trac security advisory or the CVE entry (CVE-2007-1405). Additionally, you can reach out to info@devnack.com for further support on vulnerability remediation.
Related vulnerabilities
Recent vulnerabilities recorded for trac.
