CVE-2013-4510: Directory Traversal Vulnerability in Tryton
Summary
CVE-2013-4510: Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report. Affects tryton versions < 3.0.1. Fixed in 3.0.1. How to fix ↓
Also tracked for
- trytond · PyPI
- trytond · PyPI
- tryton-client · Debian:11
The same CVE-2013-4510 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tryton is an open-source business application platform written in Python. It provides a set of modules for various business functionalities such as accounting, inventory management, and project management. The vulnerability in Tryton 3.0.0 and earlier versions allows remote servers to write arbitrary files by exploiting a directory traversal vulnerability in the client. This vulnerability arises from the mishandling of path separators in the extension of a report.
Vulnerability Detail
The directory traversal vulnerability in Tryton allows an attacker to manipulate the file path of a report extension and write arbitrary files on the server. By including path separators in the report extension, an attacker can bypass the intended file system restrictions and write files to arbitrary locations. This can lead to unauthorized access, data leakage, or even remote code execution depending on the context in which the written files are executed. The vulnerability can be exploited remotely by a malicious server.
How To Fix
Latest published version: 8.2.0 as of 22 Oct 2026
pip install --upgrade "tryton==8.2.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.1
This is the first release that contains the fix.
pip install --upgrade "tryton==3.0.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by implementing input validation and sanitization mechanisms in the affected code. Specifically, the client should validate and sanitize the report extension to prevent the inclusion of path separators. Additionally, server-side access controls and file system permissions should be configured to limit the impact of potential file writes.
Conclusion
The directory traversal vulnerability in Tryton allows remote servers to write arbitrary files on the client. This can lead to unauthorized access, data leakage, or remote code execution. It is crucial to upgrade to Tryton version 3.0.1 or later to fix the vulnerability. If immediate upgrade is not possible, implementing input validation and sanitization mechanisms can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tryton →
FAQ
The vulnerability allows remote servers to write arbitrary files on the affected Tryton client. This can lead to unauthorized access, data leakage, or even remote code execution depending on the context in which the written files are executed.
You can use the Vulert Playground at Vulert Scanner to check if your Tryton installation is affected by this vulnerability. Simply provide your Pipfile.lock and the playground will analyze it for any open-source vulnerabilities, including CVE-2013-4510.
Yes, a patch is available in Tryton version 3.0.1 and later. It is recommended to upgrade to the latest version to fix the vulnerability.
Yes, this vulnerability can be exploited remotely by a malicious server. The server can manipulate the report extension to write arbitrary files on the client.
There are no known instances of this vulnerability being exploited in the wild. However, it is important to apply the necessary security measures and upgrade to the latest version to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for tryton.
