{"id":"CVE-2004-1444","aliases":["GHSA-q7mf-hp9m-cx6f","PYSEC-2026-745"],"title":"Roundup Directory traversal vulnerability","summary":"Roundup Directory traversal vulnerability","severity":"medium","vendor":"roundup","product":"roundup","ecosystem":"pip","affected":["roundup < 0.7.3"],"patched":["roundup 0.7.3"],"published":"2022-04-29","updated":"2026-07-06","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-q7mf-hp9m-cx6f","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2004-1444"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/16350"},{"url":"https://github.com/roundup-tracker/roundup"},{"url":"http://packetstormsecurity.nl/0406-exploits/roundUP.txt"},{"url":"http://secunia.com/advisories/11801"},{"url":"http://securitytracker.com/id?1010415"},{"url":"http://sourceforge.net/tracker/index.php?func=detail&aid=961511&group_id=31577&atid=402788"},{"url":"http://www.gentoo.org/security/en/glsa/glsa-200408-09.xml"},{"url":"http://www.securityfocus.com/bid/10495"}],"tags":["osv","pip","exploit-available"],"epss":0.08865,"epssPercentile":0.95037,"exploitAvailable":true,"ingestedAt":"2026-07-08T18:25:52.124Z","exploits":{"exploitdb":true,"checkedAt":"2026-09-21T15:24:34.768Z"},"slug":"CVE-2004-1444","body":"## Overview\n\nDirectory traversal vulnerability in Roundup 0.6.4 and earlier allows remote attackers to view arbitrary files via `..` (dot dot) sequences in an `@@` command in an HTTP GET request.\n\n## Affected packages\n\n- `roundup < 0.7.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `roundup 0.7.3`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":27.5,"likelihood":1.8,"exploitation":12,"ransomware":0},"changes":[]}