MediumFix available
tryton-proteus, tryton-server — security advisory
An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.
- Products
- tryton-proteus, tryton-server
- Affected versions
- Not specified
- Fixed versions
- 6.0.16-1, 6.0.5-1
- CVEs
- CVE-2022-26661
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 14:48 UTC · Revision 1
Source evidence
An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.
osv:DEBIAN-CVE-2022-26661
tryton-proteus
Fixed versions: 6.0.5-1
tryton-proteus
Fixed versions: 6.0.5-1
tryton-proteus
Fixed versions: 6.0.5-1
tryton-server
Fixed versions: 6.0.16-1
tryton-server
Fixed versions: 6.0.16-1
tryton-server
Fixed versions: 6.0.16-1
Complete source record
{
"id": "96b354181997f7fcf273bda12550ed7835220373a43889a2dd1e18868bfbb89a",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2022-26661",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2022-26661",
"summary": "An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.",
"evidence": "osv:DEBIAN-CVE-2022-26661",
"products": [
{
"name": {
"value": "tryton-proteus",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.0.5-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tryton-proteus",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.0.5-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tryton-proteus",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.0.5-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tryton-server",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.0.16-1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tryton-server",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.0.16-1",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tryton-server",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.0.16-1",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2022-26661",
"aliases": [
"DEBIAN-CVE-2022-26661"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.5-1"
}
]
}
],
"package": {
"name": "tryton-proteus",
"purl": "pkg:deb/debian/tryton-proteus?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-26661.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.5-1"
}
]
}
],
"package": {
"name": "tryton-proteus",
"purl": "pkg:deb/debian/tryton-proteus?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-26661.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.5-1"
}
]
}
],
"package": {
"name": "tryton-proteus",
"purl": "pkg:deb/debian/tryton-proteus?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-26661.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.16-1"
}
]
}
],
"package": {
"name": "tryton-server",
"purl": "pkg:deb/debian/tryton-server?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-26661.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.16-1"
}
]
}
],
"package": {
"name": "tryton-server",
"purl": "pkg:deb/debian/tryton-server?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-26661.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.16-1"
}
]
}
],
"package": {
"name": "tryton-server",
"purl": "pkg:deb/debian/tryton-server?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-26661.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-15T08:02:17.989464503Z",
"provider": "osv",
"upstream": [
"CVE-2022-26661"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2022-26661"
]
},
"related_cves": [
{
"value": "CVE-2022-26661",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 323356,
"published_at": "2022-03-10T17:47:52.213+00:00"
}