CVE-2009-4405
Trac is vulnerable to improper policy checks and missing 'raw' role check in docutils
Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in report results when using alternate formats" or (2) a "check for the 'raw' role that is missing in docutils < 0.6."
Exploit likelihood
What each source reports
NVD Score used
Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in report results when using alternate formats" or (2) a "check for the 'raw' role that is missing in docutils < 0.6."
- Record
CVE-2009-4405- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in report results when using alternate formats" or (2) a "check for the 'raw' role that is missing in docutils < 0.6."
- Record
CVE-2009-4405- Updated
- 2026-11-02
EUVDEUVD-2009-0010 No score
Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in report results when using alternate formats" or (2) a "check for the 'raw' role that is missing in docutils < 0.6."
- Record
EUVD-2009-0010- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f9qv-j5g6-g5cr
Trac is vulnerable to improper policy checks and missing 'raw' role check in docutils
Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in report results when using alternate formats" or (2) a "check for the 'raw' role that is missing in docutils < 0.6."
- Record
GHSA-f9qv-j5g6-g5cr- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-f9qv-j5g6-g5cr
Trac is vulnerable to improper policy checks and missing 'raw' role check in docutils
Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in report results when using alternate formats" or (2) a "check for the 'raw' role that is missing in docutils < 0.6."
- Record
GHSA-f9qv-j5g6-g5cr- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSV No score
Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in report results when using alternate formats" or (2) a "check for the 'raw' role that is missing in docutils < 0.6."
- Record
CVE-2009-4405- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-4405 No score
Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in report results when using alternate formats" or (2) a "check for the 'raw' role that is missing in docutils < 0.6."
- Record
DEBIAN-CVE-2009-4405- Updated
- 2026-11-02
OSVPYSEC-2009-7 No score
Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in report results when using alternate formats" or (2) a "check for the 'raw' role that is missing in docutils < 0.6."
- Record
PYSEC-2009-7- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-4405 is a high vulnerability (CVSS 7.5) in Edgewall Trac, published December 23, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.97%, the 80th percentile. Fixed in trac 0.11.6.
References
trac.edgewall.org/browser/tags/trac-0.11.6/RELEASE
redhat.com/archives/fedora-package-announce/2009-December/msg01169.html
vupen.com/english/advisories/2009/3615
secunia.com/advisories/37807
exchange.xforce.ibmcloud.com/vulnerabilities/54983
Show 7 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=542394
nvd.nist.gov/vuln/detail/CVE-2009-4405
web.archive.org/web/20130417170303/http://secunia.com/advisories/37901
github.com/pypa/advisory-database/tree/main/vulns/trac/PYSEC-2009-7.yaml
security-tracker.debian.org/tracker/CVE-2009-4405