# trytond (PyPI) vulnerabilities 14 known vulnerabilities (1 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Weekly downloads: 6,096 - Dependents: 249 - Registry: https://pypi.org/project/trytond/ ## Advisories (14) ### [CVE-2025-66424](https://cve.now/CVE-2025-66424): Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. - Severity: Medium 6.5 - Published: Nov 30, 2025 - Affected: from 6.0.0, fixed in 6.0.70; from 7.0.0, fixed in 7.0.40; from 7.1.0, fixed in 7.4.21; from 7.5.0, fixed in 7.6.11; from 7.5.0, fixed in 7.6.11; from 7.1.0, fixed in 7.4.21; from 7.0.0, fixed in 7.0.40; from 6.0.0, fixed in 6.0.70. ### [CVE-2025-66423](https://cve.now/CVE-2025-66423): Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. - Severity: High 7.1 - Published: Nov 30, 2025 - Affected: from 7.5.0, fixed in 7.6.11; from 7.1.0, fixed in 7.4.21; from 7.0.0, fixed in 7.0.40; from 6.0.0, fixed in 6.0.70; from 6.0.0, fixed in 6.0.70; from 7.0.0, fixed in 7.0.40; from 7.1.0, fixed in 7.4.21; from 7.5.0, fixed in 7.6.11. ### [CVE-2025-66422](https://cve.now/CVE-2025-66422): Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. - Severity: Medium 4.3 - Published: Nov 30, 2025 - Affected: from 7.5.0, fixed in 7.6.11; from 7.1.0, fixed in 7.4.21; from 7.0.0, fixed in 7.0.40; fixed in 6.0.70; fixed in 6.0.70; from 7.0.0, fixed in 7.0.40; from 7.1.0, fixed in 7.4.21; from 7.5.0, fixed in 7.6.11. ### [CVE-2022-26661](https://cve.now/CVE-2022-26661): An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through… - Severity: Unrated - Published: Mar 7, 2022 - Affected: from 5.0.0, fixed in 5.0.46; from 6.0.0, fixed in 6.0.16; from 6.1.0, fixed in 6.2.6; from 5.0.0, fixed in 5.0.46; from 6.0.0, fixed in 6.0.16; from 6.1.0, fixed in 6.2.6. ### [CVE-2022-26662](https://cve.now/CVE-2022-26662): An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and… - Severity: Unrated - Published: Mar 7, 2022 - Affected: from 5.0.0, fixed in 5.0.46; from 6.0.0, fixed in 6.0.16; from 6.1.0, fixed in 6.2.6; from 5.0.0, fixed in 5.0.46; from 6.0.0, fixed in 6.0.16; from 6.1.0, fixed in 6.2.6. ### [CVE-2012-2238](https://cve.now/CVE-2012-2238): trytond 2.4: ModelView.button fails to validate authorization - Severity: Unrated - Published: Nov 21, 2019 - Affected: from 2.4.0, fixed in 2.4.2. ### [CVE-2019-10868](https://cve.now/CVE-2019-10868): In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before… - Severity: Medium 4.3 - Published: Apr 5, 2019 - Affected: from 4.2.0, fixed in 4.2.21; from 4.4.0, fixed in 4.4.19; from 4.6.0, fixed in 4.6.14; from 4.8.0, fixed in 4.8.10; from 5.0.0, fixed in 5.0.6; from 4.2.0, fixed in 4.2.21; from 4.4.0, fixed in 4.4.19; from 4.6.0, fixed in 4.6.14; from 4.8.0, fixed in 4.8.10; from 5.0.0, fixed in 5.0.6. ### [CVE-2014-6633](https://cve.now/CVE-2014-6633): The safe\_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before… - Severity: Unrated - Published: Apr 12, 2018 - Affected: from 2.4.0, fixed in 2.4.15; from 2.6.0, fixed in 2.6.14; from 2.8.0, fixed in 2.8.11; from 3.2.0, fixed in 3.2.3; from 3.0.0, fixed in 3.0.7; from 2.4.0, fixed in 2.4.15; from 2.6.0, fixed in 2.6.14; from 2.8.0, fixed in 2.8.11; from 3.0.0, fixed in 3.0.7; from 3.2.0, fixed in 3.2.3. ### [CVE-2017-0360](https://cve.now/CVE-2017-0360): file\_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a… - Severity: Unrated - Published: Apr 4, 2017 - Affected: from 3, fixed in 4.2.3; from 3.0.0, through 3.0.17; from 3.2.0, through 3.2.17; from 3.4.0, through 3.4.17; from 3.6.0, through 3.6.16; from 3.8.0, through 3.8.14; from 4.0.0, through 4.0.9; from 4.2.0, fixed in 4.2.3. ### [CVE-2016-1242](https://cve.now/CVE-2016-1242): file\_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote… - Severity: Unrated - Published: Sep 7, 2016 - Affected: fixed in 3.2.17; from 3.4, fixed in 3.4.14; from 3.6, fixed in 3.6.12; from 3.8, fixed in 3.8.8; from 4.0, fixed in 4.0.4; fixed in 3.2.17; from 3.4, fixed in 3.4.14; from 3.6, fixed in 3.6.12; from 3.8, fixed in 3.8.8; from 4.0, fixed in 4.0.4. ### [CVE-2016-1241](https://cve.now/CVE-2016-1241): Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated… - Severity: Unrated - Published: Sep 7, 2016 - Affected: fixed in 3.2.17; from 3.4, fixed in 3.4.14; from 3.6, fixed in 3.6.12; from 3.8, fixed in 3.8.8; from 4.0, fixed in 4.0.4; from 3.0.0, fixed in 3.2.17; from 3.4.0, fixed in 3.4.14; from 3.8.0, fixed in 3.8.8; from 3.6.0, fixed in 3.6.12; from 4.0.0, fixed in 4.0.4. ### [CVE-2015-0861](https://cve.now/CVE-2015-0861): model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote… - Severity: Unrated - Published: Apr 13, 2016 - Affected: from 3.2.0, fixed in 3.2.10; from 3.4.0, fixed in 3.4.8; from 3.6.0, fixed in 3.6.5; from 3.8.0, fixed in 3.8.1; from 3.2.0, fixed in 3.2.10; from 3.4.0, fixed in 3.4.8; from 3.6.0, fixed in 3.6.5; from 3.8.0, fixed in 3.8.1. ### [CVE-2013-4510](https://cve.now/CVE-2013-4510): Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to… - Severity: Unrated - Published: Nov 15, 2013 - Affected: versions 3.0.0. ### [CVE-2012-0215](https://cve.now/CVE-2012-0215): model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the… - Severity: Unrated - Published: Jul 12, 2012 - Affected: fixed in 2.2.4; fixed in 2.4.0. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/trytond Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.