CVE-2014-6633: Tryton Arbitrary Command Execution Vulnerability
Summary
CVE-2014-6633: Tryton vulnerable to arbitrary command execution. Affects tryton across 4 version ranges.
< 2.4.15
>= 2.6.0, < 2.6.14
>= 2.8.0, < 2.8.11
>= 3.2.0, < 3.2.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- trytond · PyPI
- tryton-server · Debian:11
The same CVE-2014-6633 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Tryton is an open-source business software platform that provides a modular and extensible framework for managing various business processes. It is designed to be flexible and customizable, allowing users to tailor the software to their specific needs. However, certain versions of Tryton have been found to be vulnerable to a security issue that allows remote authenticated users to execute arbitrary commands, posing a significant risk to the integrity and security of the system.
Vulnerability Detail
The vulnerability arises from the safe_eval function in the Tryton daemon (trytond), which is present in versions prior to 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3. This function allows remote authenticated users to inject shell metacharacters through the collection.domain in the webdav module or the formula field in the price_list module, enabling them to execute arbitrary commands on the server. The ramifications of this vulnerability include potential data breaches, unauthorized access to sensitive information, and complete system compromise.
How To Fix
Latest published version: 8.2.0 as of 22 Oct 2026
pip install --upgrade "tryton==8.2.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.4.152.4.15pip install --upgrade "tryton==2.4.15" -
>= 2.6.0, < 2.6.142.6.14pip install --upgrade "tryton==2.6.14" -
>= 2.8.0, < 2.8.112.8.11pip install --upgrade "tryton==2.8.11" -
>= 3.2.0, < 3.2.33.2.3pip install --upgrade "tryton==3.2.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the affected modules or to implement strict input validation to prevent the injection of shell metacharacters until the package can be updated.
Conclusion
In summary, CVE-2014-6633 represents a serious security vulnerability in Tryton that allows for arbitrary command execution by remote authenticated users. It is crucial for users to update their installations to the latest patched versions to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for tryton →
FAQ
CVE-2014-6633 is a vulnerability in Tryton that allows remote authenticated users to execute arbitrary commands on the server.
Versions of Tryton prior to 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 are affected.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The consequences include unauthorized command execution, data breaches, and potential system compromise.
As a temporary measure, restrict access to the affected modules and implement strict input validation to prevent shell metacharacter injection.
References
Related vulnerabilities
Recent vulnerabilities recorded for tryton.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
