---
id: CVE-2004-1444
aliases:
  - GHSA-q7mf-hp9m-cx6f
  - PYSEC-2026-745
title: Roundup Directory traversal vulnerability
summary: Roundup Directory traversal vulnerability
severity: medium
vendor: roundup
product: roundup
ecosystem: pip
affected:
  - roundup < 0.7.3
patched:
  - roundup 0.7.3
published: '2022-04-29'
updated: '2026-07-06'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-q7mf-hp9m-cx6f'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2004-1444'
  - url: 'https://exchange.xforce.ibmcloud.com/vulnerabilities/16350'
  - url: 'https://github.com/roundup-tracker/roundup'
  - url: 'http://packetstormsecurity.nl/0406-exploits/roundUP.txt'
  - url: 'http://secunia.com/advisories/11801'
  - url: 'http://securitytracker.com/id?1010415'
  - url: >-
      http://sourceforge.net/tracker/index.php?func=detail&aid=961511&group_id=31577&atid=402788
  - url: 'http://www.gentoo.org/security/en/glsa/glsa-200408-09.xml'
  - url: 'http://www.securityfocus.com/bid/10495'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.08865
epssPercentile: 0.95037
exploitAvailable: true
ingestedAt: '2026-07-08T18:25:52.124Z'
exploits:
  exploitdb: true
  checkedAt: '2026-09-21T15:24:34.768Z'
---

## Overview

Directory traversal vulnerability in Roundup 0.6.4 and earlier allows remote attackers to view arbitrary files via `..` (dot dot) sequences in an `@@` command in an HTTP GET request.

## Affected packages

- `roundup < 0.7.3`

## Remediation

Upgrade to a patched release:

- `roundup 0.7.3`