{"id":"CVE-2013-4510","aliases":["DEBIAN-CVE-2013-4510","DSA-2791-1","EUVD-2013-0042","GHSA-qjmc-wwmw-cq9r","PYSEC-2013-28","PYSEC-2026-1054","UBUNTU-CVE-2013-4510"],"status":"published","title":"Tryton Directory Traversal vulnerability","description":"Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report.","severity":{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:C/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02173,"percentile":0.82434,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2013-11-04T00:00:00Z","modified":"2026-09-01T20:03:18Z","fixes":[{"ecosystem":"Debian:12","package":"tryton-client","fixed_in":["2.8.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tryton-client","fixed_in":["2.8.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tryton-client","fixed_in":["2.8.4-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"tryton-client","fixed_in":["1.6.1-1+deb6u1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"tryton-client","fixed_in":["2.2.3-1+deb7u1"],"sources":["osv"]},{"ecosystem":"PyPI","package":"tryton","fixed_in":["3.0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"trytond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"last_affected":"3.0.0"}]}],"versions":["3.0.0"]},{"source":"osv","ecosystem":"Debian:12","package":"tryton-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tryton-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tryton-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"tryton-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1+deb6u1"}]}],"versions":["1.6.1-1"]},{"source":"osv","ecosystem":"Debian:7","package":"tryton-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3-1+deb7u1"}]}],"versions":["2.2.3-1"]},{"source":"osv","ecosystem":"PyPI","package":"trytond","versions":["3.0.0"]},{"source":"osv","ecosystem":"PyPI","package":"tryton","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.2.0","1.2.1","1.2.10","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","1.4.0","1.4.1","1.4.10","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8","1.8.9","2.0.0","2.0.1","2.0.10","2.0.11","2.0.12","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.2.0","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.4.0","2.4.1","2.4.10","2.4.11","2.4.12","2.4.13","2.4.14","2.4.15","2.4.16","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9","2.6.0","2.6.1","2.6.10","2.6.11","2.6.12","2.6.13","2.6.14","2.6.15","2.6.16","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.8.0","2.8.1","2.8.10","2.8.11","2.8.12","2.8.13","2.8.14","2.8.15","2.8.16","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","3.0.0"]},{"source":"osv","ecosystem":"PyPI","package":"trytond","versions":["3.0.0"]}],"products":[{"vendor":"tryton","product":"tryton"}],"references":[{"url":"http://hg.tryton.org/tryton/rev/357d0a4d9cb8","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix","web"]},{"url":"http://www.tryton.org/posts/security-release-for-issue3446.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://bugs.tryton.org/issue3446","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2013/11/04/21","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.debian.org/security/2013/dsa-2791","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4510","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/tryton/PYSEC-2013-28.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qjmc-wwmw-cq9r","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-4510","tags":["advisory"]},{"url":"https://pypi.org/project/trytond","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2013-4510","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4510","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-4510","description":"Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report.","status":"published","published":"2013-11-15T18:16:00Z","modified":"2024-08-06T16:45:14.817Z","updated_at":"2026-11-02T14:34:57.869657Z"}],"euvd":[{"id":"EUVD-2013-0042","description":"Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report.","status":"published","published":"2013-11-15T18:16:00Z","modified":"2024-08-06T16:45:14Z","updated_at":"2026-11-03T01:56:32.187151Z"}],"ghsa":[{"id":"GHSA-qjmc-wwmw-cq9r","title":"Tryton Directory Traversal vulnerability","description":"Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report.","status":"published","published":"2022-05-17T04:58:00Z","modified":"2024-11-18T22:05:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:38:20.833758Z"}],"nvd":[{"id":"CVE-2013-4510","description":"Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report.","status":"published","published":"2013-11-18T02:55:08Z","modified":"2026-06-16T23:57:21.43Z","cvss":[{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:C/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:02:40.988689Z"}],"osv":[{"id":"GHSA-qjmc-wwmw-cq9r","title":"Tryton Directory Traversal vulnerability","description":"Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report.","status":"published","published":"2022-05-17T04:58:00Z","modified":"2026-07-07T11:56:37.362518605Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"PYSEC-2026-1054","title":"Tryton Directory Traversal vulnerability","description":"Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report.","status":"published","published":"2026-07-06T08:03:26.822122Z","modified":"2026-07-07T11:56:37.362518605Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:54.622769Z"},{"id":"CVE-2013-4510","description":"Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report.","status":"published","published":"2013-11-18T02:55:08Z","modified":"2026-07-07T11:56:37.362518605Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-4510","description":"Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report.","status":"published","published":"2013-11-18T02:55:08Z","modified":"2026-09-01T20:03:18.844502138Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"DSA-2791-1","title":"tryton-client - missing input sanitization","status":"published","published":"2013-11-04T00:00:00Z","modified":"2026-03-09T01:22:02.074157Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"PYSEC-2013-28","description":"Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report.","status":"published","published":"2013-11-18T02:55:00Z","modified":"2026-07-07T11:56:37.362518605Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"UBUNTU-CVE-2013-4510","description":"Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report.","status":"withdrawn","published":"2013-11-18T02:55:00Z","modified":"2025-07-16T07:17:09.220644Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}