CVE-2008-5647: HTML Sanitizer Filter Vulnerability in Trac
Summary
CVE-2008-5647: Unspecified vulnerability in the HTML sanitizer filter in Trac before 0.11.2 allows attackers to conduct phishing attacks via unknown attack vectors. Affects trac versions < 0.11.2. Fixed in 0.11.2. How to fix ↓
Also tracked for
- trac · Debian:13
The same CVE-2008-5647 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Trac is an open-source project management and issue tracking system written in Python. It provides a web-based interface for managing software development projects. Trac is vulnerable to an unspecified vulnerability in its HTML sanitizer filter. This vulnerability allows attackers to conduct phishing attacks through unknown attack vectors.
Vulnerability Detail
The HTML sanitizer filter in Trac before version 0.11.2 is affected by an unspecified vulnerability. The exact details of the vulnerability are not disclosed. However, it enables attackers to carry out phishing attacks using unknown methods. The impact of this vulnerability can lead to the compromise of user credentials, sensitive information, and unauthorized access to the Trac system.
How To Fix
Latest published version: 1.6.0 as of 22 Oct 2026
pip install --upgrade "trac==1.6.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.11.2
This is the first release that contains the fix.
pip install --upgrade "trac==0.11.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to upgrade to the latest version of Trac as soon as possible to ensure the security of the system.
Conclusion
The HTML sanitizer filter vulnerability in Trac exposes the system to phishing attacks. To mitigate this vulnerability, it is crucial to upgrade Trac to version 0.11.2 or later. This will ensure the necessary security patches are applied. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for trac →
FAQ
Trac is an open-source project management and issue tracking system written in Python. It provides a web-based interface for managing software development projects.
This vulnerability allows attackers to conduct phishing attacks, potentially leading to the compromise of user credentials, sensitive information, and unauthorized access to the Trac system.
To fix this vulnerability, it is recommended to upgrade Trac to version 0.11.2 or later. This version includes the necessary patches and security enhancements to mitigate the vulnerability.
No specific workaround has been provided for this vulnerability. It is advised to upgrade to the latest version of Trac as soon as possible to ensure the security of the system.
For more information about this vulnerability, you can refer to the official Trac documentation or the CVE-2008-5647 advisory.
Related vulnerabilities
Recent vulnerabilities recorded for trac.
