CVE-2009-4405: Trac Multiple Unspecified Vulnerabilities
Summary
CVE-2009-4405: Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in report results when using alternate formats" or (2) a "check for the 'raw' role... Affects trac versions < 0.11.6. Fixed in 0.11.6. How to fix ↓
Also tracked for
- trac · Debian:13
The same CVE-2009-4405 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Trac is an open-source project management and issue tracking system written in Python. It provides a web-based interface for managing software development projects. Trac allows users to create and track tickets, manage source code repositories, and collaborate with team members. This vulnerability affects Trac versions prior to 0.11.6.
Vulnerability Detail
Multiple unspecified vulnerabilities have been discovered in Trac before version 0.11.6. The exact details of these vulnerabilities are unknown, including their impact and attack vectors. However, they may be related to two specific issues. The first issue involves policy checks in report results when using alternate formats. The second issue is a missing check for the 'raw' role in docutils versions prior to 0.6. These vulnerabilities could potentially be exploited by attackers to gain unauthorized access, execute arbitrary code, or perform other malicious activities.
How To Fix
Latest published version: 1.6.0 as of 22 Oct 2026
pip install --upgrade "trac==1.6.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.11.6
This is the first release that contains the fix.
pip install --upgrade "trac==0.11.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Multiple unspecified vulnerabilities have been discovered in Trac versions prior to 0.11.6. These vulnerabilities could potentially be exploited by attackers to gain unauthorized access or execute arbitrary code. It is strongly recommended to upgrade Trac to version 0.11.6 or later to mitigate these vulnerabilities. For further assistance and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for trac →
FAQ
These vulnerabilities affect Trac versions prior to 0.11.6.
There are no known exploits for these vulnerabilities at this time.
Yes, these vulnerabilities can potentially be exploited remotely by attackers.
No specific workarounds have been provided for these vulnerabilities. It is recommended to upgrade to Trac version 0.11.6 or later.
More information about these vulnerabilities can be found in the Trac advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/trac/PYSEC-2009-7.yaml
Related vulnerabilities
Recent vulnerabilities recorded for trac.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
