CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2022-26661
Medium (6.5). EPSS 1.4% chance of exploitation in the next 30 days. Fixed in trytond 5.0.46, 6.0.16, 6.2.6.
An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.
Severity
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
- CWE
- CWE-611
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- tryton:proteus
- tryton:trytond
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cj78-rgw3-4h5p | PyPI | trytond | >=5.0.0 <5.0.46 | 5.0.46 |
| GHSA-cj78-rgw3-4h5p | PyPI | trytond | >=6.0.0 <6.0.16 | 6.0.16 |
| GHSA-cj78-rgw3-4h5p | PyPI | trytond | >=6.1.0 <6.2.6 | 6.2.6 |
| GHSA-cj78-rgw3-4h5p | PyPI | proteus | >=5.0.0 <5.0.12 | 5.0.12 |
| GHSA-cj78-rgw3-4h5p | PyPI | proteus | >=6.0.0 <6.0.5 | 6.0.5 |
| GHSA-cj78-rgw3-4h5p | PyPI | proteus | >=6.1.0 <6.2.2 | 6.2.2 |
| PYSEC-2022-43170 | PyPI | tryton | >=5.0.0 <5.0.12 >=6.0.0 <6.0.5 >=6.2.0 <6.2.2 <6.2.6 <6.0.16 <5.0.46 | 5.0.12, 6.0.5, 6.2.2, 6.2.6, 6.0.16, 5.0.46 |
| PYSEC-2026-3391 | PyPI | trytond | >=5.0.0 <5.0.46 >=6.0.0 <6.0.16 >=6.1.0 <6.2.6 | 5.0.46, 6.0.16, 6.2.6 |
| PYSEC-2026-740 | PyPI | proteus | >=5.0.0 <5.0.12 >=6.0.0 <6.0.5 >=6.1.0 <6.2.2 | 5.0.12, 6.0.5, 6.2.2 |