Arbitrary Command Execution in Tryton
Summary
CVE-2014-6633: Tryton vulnerable to arbitrary command execution. Affects tryton across 4 version ranges.
< 2.4.15
>= 2.6.0, < 2.6.14
>= 2.8.0, < 2.8.11
>= 3.2.0, < 3.2.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- trytond · PyPI
- tryton-server · Debian:11
The same CVE-2014-6633 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tryton is an open-source business application platform written in Python. It provides a set of modules for various business operations such as accounting, inventory management, and sales. However, Tryton versions before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 are vulnerable to arbitrary command execution.
Vulnerability Detail
The vulnerability exists in the safe_eval function in the trytond module of Tryton. This function allows remote authenticated users to execute arbitrary commands by exploiting shell metacharacters in either the collection.domain parameter in the webdav module or the formula field in the price_list module. An attacker with authenticated access to the affected Tryton instance can craft malicious input to execute arbitrary commands on the underlying system. This can lead to unauthorized access, data leakage, or even complete compromise of the system.
How To Fix
Latest published version: 8.2.0 as of 22 Oct 2026
pip install --upgrade "tryton==8.2.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.4.152.4.15pip install --upgrade "tryton==2.4.15" -
>= 2.6.0, < 2.6.142.6.14pip install --upgrade "tryton==2.6.14" -
>= 2.8.0, < 2.8.112.8.11pip install --upgrade "tryton==2.8.11" -
>= 3.2.0, < 3.2.33.2.3pip install --upgrade "tryton==3.2.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a patched version is not immediately feasible, a temporary workaround can be implemented by restricting access to the affected modules or disabling the functionality that utilizes the vulnerable safe_eval function. However, this workaround may impact the normal operation of the Tryton application and should only be considered as a temporary measure until the upgrade can be performed.
Conclusion
The arbitrary command execution vulnerability in Tryton can be mitigated by upgrading to the patched versions or implementing temporary workarounds. It is crucial to prioritize the security of the system and take necessary actions to prevent unauthorized access or compromise. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tryton →
FAQ
Tryton is an open-source business application platform written in Python. It provides a set of modules for various business operations such as accounting, inventory management, and sales.
Tryton versions before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 are affected by this vulnerability.
An attacker with authenticated access to the affected Tryton instance can exploit this vulnerability by crafting malicious input containing shell metacharacters in the collection.domain parameter in the webdav module or the formula field in the price_list module.
Exploiting this vulnerability can lead to unauthorized access, data leakage, or even complete compromise of the system running the vulnerable Tryton instance.
Yes, upgrading Tryton to version 2.4.15, 2.6.14, 2.8.11, 3.0.7, or 3.2.3 will fix this vulnerability. It is recommended to update the Tryton installation as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for tryton.
