{"action":"Upgrade trac to 0.9.6 or later.","affected":[{"fixed":"0.9.6","introduced":"0"}],"component":"trac","cve_ids":["CVE-2006-3695"],"ecosystem":"PyPI","epss":0.01899,"exploited":false,"fixed_versions":["0.9.6"],"ghsa_id":"GHSA-r524-c2gf-5chr","id":"tcs_01M5KG51Y9XRYVRDJ2HRW92GXF","modified_at":"2026-06-10T17:02:44.573390909Z","published_at":"2006-07-21T14:03:00Z","references":["https://osv.dev/vulnerability/PYSEC-2006-2","http://trac.edgewall.org/wiki/ChangeLog","http://securitytracker.com/id?1016457","http://www.debian.org/security/2006/dsa-1152","http://secunia.com/advisories/20958","http://secunia.com/advisories/21534","http://www.securityfocus.com/bid/18323","http://www.vupen.com/english/advisories/2006/2729","https://exchange.xforce.ibmcloud.com/vulnerabilities/27708","https://exchange.xforce.ibmcloud.com/vulnerabilities/27706","https://github.com/advisories/GHSA-r524-c2gf-5chr"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2006-2","url":"https://osv.dev/vulnerability/PYSEC-2006-2"}],"summary":"Trac before 0.9.6 does not disable the \"raw\" or \"include\" commands when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows remote attackers t"}