Every CVE Search/ Get API key

CVE-2014-6633

Tryton vulnerable to arbitrary command execution

8.8 HighFix available

CVE-2014-6633 is a high vulnerability (CVSS 8.8) in Tryton, published October 4, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.58%, the 85th percentile. Fixed in tryton 2.4.15.

The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.58%Up 1.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 8.8

The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module.

Record
CVE-2014-6633
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
9.0 HighAV:N/AC:L/Au:S/C:C/I:C/A:C
Weakness
CWE-77
Updated
2026-11-02
CVE List No score

The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module.

Record
CVE-2014-6633
Updated
2026-11-02
EUVDEUVD-2018-0143 No score

The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module.

Record
EUVD-2018-0143
Updated
2026-11-03
GitHub AdvisoriesGHSA-m9jj-5qvj-5fhx 8.7

Tryton vulnerable to arbitrary command execution

The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module.

Record
GHSA-m9jj-5qvj-5fhx
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77
Updated
2026-11-02
OSV 8.8

The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module.

Record
CVE-2014-6633
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2014-6633 8.8

The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module.

Record
DEBIAN-CVE-2014-6633
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-m9jj-5qvj-5fhx 8.7

Tryton vulnerable to arbitrary command execution

The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module.

Record
GHSA-m9jj-5qvj-5fhx
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77
Updated
2026-11-02
OSVPYSEC-2026-3390 8.7

Tryton vulnerable to arbitrary command execution

The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module.

Record
PYSEC-2026-3390
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVPYSEC-2018-59 No score

The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module.

Record
PYSEC-2018-59
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tryton
PyPI
 before 2.4.15
2.4.15
tryton
PyPI
 2.6.0 up to 2.6.14
2.6.14
tryton
PyPI
 2.8.0 up to 2.8.11
2.8.11
tryton
PyPI
 3.2.0 up to 3.2.3
3.2.3
trytond
PyPI
 2.4.0 up to 2.4.15
2.4.15
trytond
PyPI
 2.6.0 up to 2.6.14
2.6.14
trytond
PyPI
 2.8.0 up to 2.8.11
2.8.11
trytond
PyPI
 3.2.0 up to 3.2.3
3.2.3
trytond
PyPI
 3.0.0 up to 3.0.7
3.0.7
tryton-server
Debian:12
 before 3.2.3-1
3.2.3-1
Show 15 moreShow less
Affected packages
PackageAffectedFixed
tryton-server
Debian:13
 before 3.2.3-1
3.2.3-1
tryton-server
Debian:14
 before 3.2.3-1
3.2.3-1
tryton-server
Debian:6.0
 before 1.6.1-2+squeeze2, plus listed versions
1.6.1-21.6.1-2+squeeze1
1.6.1-2+squeeze2
tryton-server
Debian:7
 before 2.2.4-1+deb7u2, plus listed versions
2.2.4-12.2.4-1+deb7u1
2.2.4-1+deb7u2
tryton
PyPI
 before 2.4.15, plus listed versions
1.0.01.0.11.0.21.0.31.0.4
Show 45 moreShow less
1.0.51.0.61.0.71.0.81.0.91.2.01.2.11.2.101.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.61.4.71.4.81.4.91.6.01.6.11.6.21.6.31.6.41.6.51.6.61.6.71.6.81.6.91.8.01.8.11.8.21.8.31.8.41.8.51.8.61.8.7
2.4.15
tryton
PyPI
 2.6.0 up to 2.6.14, plus listed versions
2.6.12.6.102.6.112.6.122.6.13
Show 8 moreShow less
2.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.9
2.6.14
tryton
PyPI
 2.8.0 up to 2.8.11, plus listed versions
2.8.12.8.102.8.22.8.32.8.4
Show 5 moreShow less
2.8.52.8.62.8.72.8.82.8.9
2.8.11
tryton
PyPI
 3.2.0 up to 3.2.3, plus listed versions
3.2.13.2.2
3.2.3
trytond
PyPI
 2.4.0 up to 2.4.15, plus listed versions
2.4.12.4.102.4.112.4.122.4.13
Show 9 moreShow less
2.4.142.4.22.4.32.4.42.4.52.4.62.4.72.4.82.4.9
2.4.15
trytond
PyPI
 2.6.0 up to 2.6.14, plus listed versions
2.6.12.6.102.6.112.6.122.6.13
Show 8 moreShow less
2.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.9
2.6.14
trytond
PyPI
 2.8.0 up to 2.8.11, plus listed versions
2.8.12.8.102.8.22.8.32.8.4
Show 5 moreShow less
2.8.52.8.62.8.72.8.82.8.9
2.8.11
trytond
PyPI
 3.2.0 up to 3.2.3, plus listed versions
3.2.13.2.2
3.2.3
trytond
PyPI
 3.0.0 up to 3.0.7, plus listed versions
3.0.13.0.23.0.33.0.43.0.53.0.6
3.0.7
trytond
PyPI
 2.4.0 up to 2.4.15, 2.6.0 up to 2.6.14, 2.8.0 up to 2.8.11, 3.0.0 up to 3.0.7, 3.2.0 up to 3.2.3, plus listed versions
2.4.12.4.102.4.112.4.122.4.13
Show 40 moreShow less
2.4.142.4.22.4.32.4.42.4.52.4.62.4.72.4.82.4.92.6.12.6.102.6.112.6.122.6.132.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.92.8.12.8.102.8.22.8.32.8.42.8.52.8.62.8.72.8.82.8.93.0.13.0.23.0.33.0.43.0.53.0.63.2.13.2.2
2.4.152.6.142.8.113.0.73.2.3
tryton
PyPI
 before 2.4.15, 2.6.0 up to 2.6.14, 2.8.0 up to 2.8.11, 3.2.0 up to 3.2.3, plus listed versions
1.0.01.0.11.0.21.0.31.0.4
Show 45 moreShow less
1.0.51.0.61.0.71.0.81.0.91.2.01.2.11.2.101.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.61.4.71.4.81.4.91.6.01.6.11.6.21.6.31.6.41.6.51.6.61.6.71.6.81.6.91.8.01.8.11.8.21.8.31.8.41.8.51.8.61.8.7
2.4.152.6.142.8.113.2.3

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 4 moreShow less
This page doesn't list everything

Left out here: 113 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open