CVE-2022-26661: Tryton Application Platform XXE Vulnerability Allows File Access
Summary
CVE-2022-26661: An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5... Affects tryton across 6 version ranges.
>= 5.0.0, < 5.0.12
< 5.0.46
>= 6.0.0, < 6.0.5
< 6.0.16
>= 6.2.0, < 6.2.2
< 6.2.6
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- trytond · PyPI
- proteus · PyPI
- trytond · PyPI
- tryton-proteus · Debian:11
The same CVE-2022-26661 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tryton is an open-source application platform that provides a modular and extensible framework for building business applications. It is designed to facilitate the development of complex applications with a focus on usability and flexibility. The platform includes a server component and a command-line client (proteus) for interacting with the server. This vulnerability affects multiple versions of Tryton, allowing authenticated users to exploit the system through crafted XML files.
Vulnerability Detail
An XXE (XML External Entity) vulnerability was discovered in the Tryton Application Platform, affecting versions 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5. This vulnerability allows an authenticated user to craft a malicious XML SEPA file that, when parsed by the server, can lead to unauthorized access to arbitrary files on the system. The potential ramifications include exposure of sensitive data and system compromise, making it critical to address this issue promptly.
How To Fix
Latest published version: 8.2.0 as of 22 Oct 2026
pip install --upgrade "tryton==8.2.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 5.0.0, < 5.0.125.0.12pip install --upgrade "tryton==5.0.12" -
< 5.0.465.0.46pip install --upgrade "tryton==5.0.46" -
>= 6.0.0, < 6.0.56.0.5pip install --upgrade "tryton==6.0.5" -
< 6.0.166.0.16pip install --upgrade "tryton==6.0.16" -
>= 6.2.0, < 6.2.26.2.2pip install --upgrade "tryton==6.2.2" -
< 6.2.66.2.6pip install --upgrade "tryton==6.2.6"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, restrict access to the Tryton server to trusted users only. Additionally, consider disabling XML parsing features if they are not required for your application.
Conclusion
The XXE vulnerability in the Tryton Application Platform poses a significant risk to systems running affected versions. It is crucial for users to update to the latest patched versions to mitigate potential security threats. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for tryton →
FAQ
XXE (XML External Entity) vulnerabilities occur when an application processes XML input from untrusted sources and allows access to external entities, potentially leading to unauthorized file access or server-side request forgery.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences include unauthorized access to sensitive files on the server, which can lead to data breaches and further exploitation of the system.
Yes, you can restrict access to the Tryton server and disable XML parsing features as a temporary measure until you can apply the necessary updates.
The CVSS score for this vulnerability is 6.5, indicating a medium severity level that requires prompt attention.
Related vulnerabilities
Recent vulnerabilities recorded for tryton.
