Medium

Roundup Directory traversal vulnerability

Disclosed: 29.04.2022
Updated: 11.10.2026 13:17

Directory traversal vulnerability in Roundup 0.6.4 and earlier allows remote attackers to view arbitrary files via .. (dot dot) sequences in an @@ command in an HTTP GET request.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Python (PyPI)	roundup	< 0.7.3	0.7.3

References

CVSS score -

Weakness (CWE): CWE-22
Platform: Python (PyPI)
Package: roundup
Disclosed: 29.04.2022
Updated: 11.10.2026 13:17

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-745 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-q7mf-hp9m-cx6f - CC BY 4.0

Vulnerability history: roundup

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (15) in the archive

Total entries: 15
First → latest: 03.2008 07.2025
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

Critical 1
Medium 14

Disclosures per year

2017: 0
2018: 0
2019: 1
2020: 1
2021: 0
2022: 2
2023: 0
2024: 3
2025: 1
2026: 0

earlier: 7

29.04.2022

Roundup Directory traversal vulnerability this entry

Medium CVE-2004-1444 < 0.7.3 0.7.3
24.03.2008

The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set

Critical · 9.1 CVE-2008-1475 < 1.4.5 1.4.5

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application