{"id":"CVE-2022-26661","aliases":["DEBIAN-CVE-2022-26661","DLA-2945-1","DLA-2946-1","DSA-5098-1","DSA-5099-1","EUVD-2022-0342","GHSA-cj78-rgw3-4h5p","PYSEC-2022-43170","PYSEC-2026-3391","PYSEC-2026-740","UBUNTU-CVE-2022-26661"],"status":"published","title":"Improper Restriction of XML External Entity Reference in trytond and proteus","description":"An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01407,"percentile":0.72971,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2022-03-07T22:40:11Z","modified":"2026-11-03T06:01:49Z","fixes":[{"ecosystem":"PyPI","package":"trytond","fixed_in":["5.0.46","6.0.16","6.2.6"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"proteus","fixed_in":["5.0.12","6.0.5","6.2.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"tryton-proteus","fixed_in":["6.0.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tryton-proteus","fixed_in":["6.0.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tryton-proteus","fixed_in":["6.0.5-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tryton-server","fixed_in":["6.0.16-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tryton-server","fixed_in":["6.0.16-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tryton-server","fixed_in":["6.0.16-1"],"sources":["osv"]},{"ecosystem":"PyPI","package":"tryton","fixed_in":["5.0.12","6.0.5","6.2.2","6.2.6","6.0.16","5.0.46"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"trytond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.46"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"trytond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.16"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"trytond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"fixed":"6.2.6"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.12"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.5"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"fixed":"6.2.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.5-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.16-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.16-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.16-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-2+deb9u2"}]}],"versions":["4.2.1-2","4.2.1-2+deb9u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-1+deb9u1"}]}],"versions":["4.2.0-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.4-2+deb10u1"}]}],"versions":["5.0.4-2"],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.33-2+deb11u1"}]}],"versions":["5.0.33-2"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-3+deb10u1"}]}],"versions":["5.0.1-3"],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.8-1+deb11u1"}]}],"versions":["5.0.8-1"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"trytond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.46"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.15","5.0.16","5.0.17","5.0.18","5.0.19","5.0.2","5.0.20","5.0.21","5.0.22","5.0.23","5.0.24","5.0.25","5.0.26","5.0.27","5.0.28","5.0.29","5.0.3","5.0.30","5.0.31","5.0.32","5.0.33","5.0.34","5.0.35","5.0.36","5.0.37","5.0.38","5.0.39","5.0.4","5.0.40","5.0.41","5.0.42","5.0.43","5.0.44","5.0.45","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"]},{"source":"osv","ecosystem":"PyPI","package":"trytond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.16"}]}],"versions":["6.0.0","6.0.1","6.0.10","6.0.11","6.0.12","6.0.13","6.0.14","6.0.15","6.0.2","6.0.3","6.0.4","6.0.5","6.0.6","6.0.7","6.0.8","6.0.9"]},{"source":"osv","ecosystem":"PyPI","package":"trytond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"fixed":"6.2.6"}]}],"versions":["6.2.0","6.2.1","6.2.2","6.2.3","6.2.4","6.2.5"]},{"source":"osv","ecosystem":"PyPI","package":"proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.12"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"]},{"source":"osv","ecosystem":"PyPI","package":"proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.5"}]}],"versions":["6.0.0","6.0.1","6.0.2","6.0.3","6.0.4"]},{"source":"osv","ecosystem":"PyPI","package":"proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"fixed":"6.2.2"}]}],"versions":["6.2.0","6.2.1"]},{"source":"osv","ecosystem":"PyPI","package":"tryton","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.12"},{"introduced":"6.0.0"},{"fixed":"6.0.5"},{"introduced":"6.2.0"},{"fixed":"6.2.2"},{"fixed":"6.2.6"},{"fixed":"6.0.16"},{"fixed":"5.0.46"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9","6.0.0","6.0.1","6.0.2","6.0.3","6.0.4","6.2.0","6.2.1"]},{"source":"osv","ecosystem":"PyPI","package":"trytond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.46"},{"introduced":"6.0.0"},{"fixed":"6.0.16"},{"introduced":"6.1.0"},{"fixed":"6.2.6"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.15","5.0.16","5.0.17","5.0.18","5.0.19","5.0.2","5.0.20","5.0.21","5.0.22","5.0.23","5.0.24","5.0.25","5.0.26","5.0.27","5.0.28","5.0.29","5.0.3","5.0.30","5.0.31","5.0.32","5.0.33","5.0.34","5.0.35","5.0.36","5.0.37","5.0.38","5.0.39","5.0.4","5.0.40","5.0.41","5.0.42","5.0.43","5.0.44","5.0.45","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9","6.0.0","6.0.1","6.0.10","6.0.11","6.0.12","6.0.13","6.0.14","6.0.15","6.0.2","6.0.3","6.0.4","6.0.5","6.0.6","6.0.7","6.0.8","6.0.9","6.2.0","6.2.1","6.2.2","6.2.3","6.2.4","6.2.5"]},{"source":"osv","ecosystem":"PyPI","package":"proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.12"},{"introduced":"6.0.0"},{"fixed":"6.0.5"},{"introduced":"6.1.0"},{"fixed":"6.2.2"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9","6.0.0","6.0.1","6.0.2","6.0.3","6.0.4","6.2.0","6.2.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.1-1","3.8.0-1","3.8.1-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.2-1","3.6.3-2","3.6.3-3","3.8.0-1","3.8.1-1","3.8.2-1","3.8.3-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.0-4","4.6.0-1","4.6.1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.3-3","4.6.0-1","4.6.1-1","4.6.2-1","4.6.3-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.3-2","5.0.7-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.10-1","5.0.14-2","5.0.16-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.8-1","6.0.3-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.33-2","6.0.9-3","6.0.12-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.8-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.34-1","6.0.36-1","6.0.39-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.1-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.24-1","7.0.30-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.3-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.43-1","7.0.47-1","7.0.53-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tryton-proteus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.1-3","7.0.2-1","7.0.3-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tryton-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.30-1","7.0.38-1","7.0.40-1","7.0.43-1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"tryton","product":"proteus"},{"vendor":"tryton","product":"trytond"}],"references":[{"url":"https://bugs.tryton.org/issue11219","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Vendor Advisory","web","advisory","report"]},{"url":"https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","web","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00017.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://www.debian.org/security/2022/dsa-5098","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2022/dsa-5099","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26661","tags":["advisory"]},{"url":"https://foss.heptapod.net/tryton/tryton/-/issues/11219","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cj78-rgw3-4h5p","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26661.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-26661","tags":["advisory"]},{"url":"https://hg.tryton.org/trytond","tags":["package"]},{"url":"https://pypi.org/project/trytond","tags":["package"]},{"url":"https://pypi.org/project/proteus","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-26661","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-26661","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-26661","description":"An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.","status":"published","published":"2022-03-07T22:40:11Z","modified":"2024-08-03T05:11:44.6Z","updated_at":"2026-11-02T14:34:25.954329Z"}],"euvd":[{"id":"EUVD-2022-0342","description":"An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.","status":"published","published":"2022-03-07T22:40:11Z","modified":"2024-08-03T05:11:44Z","updated_at":"2026-11-03T03:25:44.694159Z"}],"ghsa":[{"id":"GHSA-cj78-rgw3-4h5p","title":"Improper Restriction of XML External Entity Reference in trytond and proteus","description":"An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.","status":"published","published":"2022-03-11T00:02:02Z","modified":"2023-08-31T21:00:33Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:37:02.095916Z"}],"nvd":[{"id":"CVE-2022-26661","description":"An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.","status":"published","published":"2022-03-10T17:47:52.213Z","modified":"2026-06-17T04:35:36.5Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:07:13.7085Z"}],"osv":[{"id":"GHSA-cj78-rgw3-4h5p","title":"Improper Restriction of XML External Entity Reference in trytond and proteus","description":"An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.","status":"published","published":"2022-03-11T00:02:02Z","modified":"2026-07-13T16:42:28.245581563Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"PYSEC-2022-43170","description":"An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.","status":"published","published":"2022-03-10T17:47:00Z","modified":"2026-07-13T16:42:28.245581563Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:53.449407Z"},{"id":"PYSEC-2026-3391","title":"Improper Restriction of XML External Entity Reference in trytond and proteus","description":"An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.","status":"published","published":"2026-07-09T16:49:44.956239Z","modified":"2026-07-13T16:42:28.245581563Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:56.847083Z"},{"id":"PYSEC-2026-740","title":"Improper Restriction of XML External Entity Reference in trytond and proteus","description":"An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.","status":"published","published":"2026-07-02T14:13:15.757085Z","modified":"2026-07-13T16:42:28.245581563Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"UBUNTU-CVE-2022-26661","description":"An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.","status":"published","published":"2022-03-10T17:47:00Z","modified":"2026-10-17T12:55:57.983278084Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"CVE-2022-26661","description":"An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.","status":"published","published":"2022-03-07T22:40:11Z","modified":"2026-10-28T02:30:31.515451019Z","updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"DEBIAN-CVE-2022-26661","description":"An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.","status":"published","published":"2022-03-10T17:47:52.213Z","modified":"2026-11-03T06:01:49.84924652Z","updated_at":"2026-11-03T06:44:26.638603Z"},{"id":"DLA-2945-1","title":"tryton-server - security update","status":"published","published":"2022-03-11T00:00:00Z","modified":"2026-03-09T01:20:35.608261Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-2946-1","title":"tryton-proteus - security update","status":"published","published":"2022-03-11T00:00:00Z","modified":"2026-03-09T01:21:54.156357Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5098-1","title":"tryton-server - security update","status":"published","published":"2022-03-10T00:00:00Z","modified":"2026-03-09T02:11:18.831979Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"DSA-5099-1","title":"tryton-proteus - security update","status":"published","published":"2022-03-10T00:00:00Z","modified":"2026-03-09T02:10:05.628637Z","updated_at":"2026-11-02T15:46:17.543497Z"}]}}