Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

trytond

14 known vulnerabilities (1 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
14 · 1 high, 3 medium
Weekly downloads
6,096
Dependents
249
Registry
PyPI

Advisories 14

  • CVE-2025-66424Medium 6.5

    Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export.

    Affected: from 6.0.0, fixed in 6.0.70; from 7.0.0, fixed in 7.0.40; from 7.1.0, fixed in 7.4.21; from 7.5.0, fixed in 7.6.11; from 7.5.0, fixed in 7.6.11; from 7.1.0, fixed in 7.4.21; from 7.0.0, fixed in 7.0.40; from 6.0.0, fixed in 6.0.70.

  • Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor.

    Affected: from 7.5.0, fixed in 7.6.11; from 7.1.0, fixed in 7.4.21; from 7.0.0, fixed in 7.0.40; from 6.0.0, fixed in 6.0.70; from 6.0.0, fixed in 6.0.70; from 7.0.0, fixed in 7.0.40; from 7.1.0, fixed in 7.4.21; from 7.5.0, fixed in 7.6.11.

  • CVE-2025-66422Medium 4.3

    Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information.

    Affected: from 7.5.0, fixed in 7.6.11; from 7.1.0, fixed in 7.4.21; from 7.0.0, fixed in 7.0.40; fixed in 6.0.70; fixed in 6.0.70; from 7.0.0, fixed in 7.0.40; from 7.1.0, fixed in 7.4.21; from 7.5.0, fixed in 7.6.11.

  • An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through…

    Affected: from 5.0.0, fixed in 5.0.46; from 6.0.0, fixed in 6.0.16; from 6.1.0, fixed in 6.2.6; from 5.0.0, fixed in 5.0.46; from 6.0.0, fixed in 6.0.16; from 6.1.0, fixed in 6.2.6.

  • An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and…

    Affected: from 5.0.0, fixed in 5.0.46; from 6.0.0, fixed in 6.0.16; from 6.1.0, fixed in 6.2.6; from 5.0.0, fixed in 5.0.46; from 6.0.0, fixed in 6.0.16; from 6.1.0, fixed in 6.2.6.

  • trytond 2.4: ModelView.button fails to validate authorization

    Affected: from 2.4.0, fixed in 2.4.2.

  • CVE-2019-10868Medium 4.3

    In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before…

    Affected: from 4.2.0, fixed in 4.2.21; from 4.4.0, fixed in 4.4.19; from 4.6.0, fixed in 4.6.14; from 4.8.0, fixed in 4.8.10; from 5.0.0, fixed in 5.0.6; from 4.2.0, fixed in 4.2.21; from 4.4.0, fixed in 4.4.19; from 4.6.0, fixed in 4.6.14; from 4.8.0, fixed in 4.8.10; from 5.0.0, fixed in 5.0.6.

  • The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before…

    Affected: from 2.4.0, fixed in 2.4.15; from 2.6.0, fixed in 2.6.14; from 2.8.0, fixed in 2.8.11; from 3.2.0, fixed in 3.2.3; from 3.0.0, fixed in 3.0.7; from 2.4.0, fixed in 2.4.15; from 2.6.0, fixed in 2.6.14; from 2.8.0, fixed in 2.8.11; from 3.0.0, fixed in 3.0.7; from 3.2.0, fixed in 3.2.3.

  • file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a…

    Affected: from 3, fixed in 4.2.3; from 3.0.0, through 3.0.17; from 3.2.0, through 3.2.17; from 3.4.0, through 3.4.17; from 3.6.0, through 3.6.16; from 3.8.0, through 3.8.14; from 4.0.0, through 4.0.9; from 4.2.0, fixed in 4.2.3.

  • file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote…

    Affected: fixed in 3.2.17; from 3.4, fixed in 3.4.14; from 3.6, fixed in 3.6.12; from 3.8, fixed in 3.8.8; from 4.0, fixed in 4.0.4; fixed in 3.2.17; from 3.4, fixed in 3.4.14; from 3.6, fixed in 3.6.12; from 3.8, fixed in 3.8.8; from 4.0, fixed in 4.0.4.

  • Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated…

    Affected: fixed in 3.2.17; from 3.4, fixed in 3.4.14; from 3.6, fixed in 3.6.12; from 3.8, fixed in 3.8.8; from 4.0, fixed in 4.0.4; from 3.0.0, fixed in 3.2.17; from 3.4.0, fixed in 3.4.14; from 3.8.0, fixed in 3.8.8; from 3.6.0, fixed in 3.6.12; from 4.0.0, fixed in 4.0.4.

  • model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote…

    Affected: from 3.2.0, fixed in 3.2.10; from 3.4.0, fixed in 3.4.8; from 3.6.0, fixed in 3.6.5; from 3.8.0, fixed in 3.8.1; from 3.2.0, fixed in 3.2.10; from 3.4.0, fixed in 3.4.8; from 3.6.0, fixed in 3.6.5; from 3.8.0, fixed in 3.8.1.

  • Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to…

    Affected: versions 3.0.0.

  • model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the…

    Affected: fixed in 2.2.4; fixed in 2.4.0.