PYSEC-2026-3390 Tryton vulnerable to arbitrary command execution

The safeeval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in 1 the collection.domain in the webdav module or 2 the formula...

trytond does not enforce access rights for the route of the HTML editor.

Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70...

trytond allows remote attackers to obtain sensitive trace-back (server setup) information

Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back server setup information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70...

trytond does not enforce access rights for data export

Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70...

PYSEC-2026-1989 trytond does not enforce access rights for data export

Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70...

PYSEC-2026-1991 trytond does not enforce access rights for the route of the HTML editor.

Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70...

trytond-account (>=4.0.2, <=4.0.16), trytond-account-asset (>=4.0.2, <=4.0.4) +41 more potentially affected by CVE-2025-66422 via trytond (4.0.20)

trytond PYPI version 4.0.20 is affected by a known vulnerability. The following packages have a transitive dependency on trytond and may be impacted: - trytond-account =4.0.2, =4.0.2, =4.0.2, =4.0.2, =4.0.2, =4.0.2, =4.0.2, =4.0.2, =4.0.2, =4.0.2, =4.0.2, =4.0.4 and more Source cves: CVE-2025-664...

trytond-account (>=4.2.0, <=4.2.11), trytond-account-asset (>=4.2.0, <=4.2.3) +99 more potentially affected by CVE-2025-66422 via trytond (4.2.22)

trytond PYPI version 4.2.22 is affected by a known vulnerability. The following packages have a transitive dependency on trytond and may be impacted: - trytond-account =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.1 and more Source cves: CVE-2025-66422 Source advisory: OSV:PYSEC-2026-1990...

trytond-account (>=4.4.0, <=4.4.12), trytond-account-asset (>=4.4.0, <=4.4.4) +105 more potentially affected by CVE-2025-66422 via trytond (4.4.27)

trytond PYPI version 4.4.27 is affected by a known vulnerability. The following packages have a transitive dependency on trytond and may be impacted: - trytond-account =4.4.0, =4.4.0, =4.4.0, =4.4.0, =4.4.0, =4.4.0, =4.4.1 - trytond-account-invoice-line-standalone 4.4.0 -...

mds-account-de-skr04 (>=4.6.0, <=4.6.1), mds-account-invoice-confirmpost (4.6.0) +133 more potentially affected by CVE-2025-66422 via trytond (4.6.22)

trytond PYPI version 4.6.22 is affected by a known vulnerability. The following packages have a transitive dependency on trytond and may be impacted: - mds-account-de-skr04 =4.6.0, =4.6.0, =4.6.0, =4.6.4, =4.6.0, =4.6.0, =4.6.0, =4.6.0, =4.6.4 and more Source cves: CVE-2025-66422 Source advisory:...

kalenis-lims (4.8.0), lls-trytond-sale-subscription-asset (4.8.1) +134 more potentially affected by CVE-2025-66422 via trytond (4.8.18)

trytond PYPI version 4.8.18 is affected by a known vulnerability. The following packages have a transitive dependency on trytond and may be impacted: - kalenis-lims 4.8.0 - lls-trytond-sale-subscription-asset 4.8.1 - mds-account-de-skr04 4.8.1 - mds-account-invoice-confirmpost 4.8.0 -...

a4t-sale-discount (5.0.2), kalenis-lims (5.0.0) +144 more potentially affected by CVE-2025-66422 via trytond (5.0.63)

trytond PYPI version 5.0.63 is affected by a known vulnerability. The following packages have a transitive dependency on trytond and may be impacted: - a4t-sale-discount 5.0.2 - kalenis-lims 5.0.0 - mds-account-aged-balance-defaults 5.0.0 - mds-account-de-skr04 5.0.0 -...

m9s-account-banking-import (>=5.2.0, <=5.2.7), m9s-account-banking-import-hibiscus (>=5.2.0, <=5.2.4) +218 more potentially affected by CVE-2025-66422 via trytond (5.2.20)

trytond PYPI version 5.2.20 is affected by a known vulnerability. The following packages have a transitive dependency on trytond and may be impacted: - m9s-account-banking-import =5.2.0, =5.2.0, =5.2.0, =5.2.0, =5.2.2, =5.2.0, =5.2.0, =5.2.0, =5.2.0, =5.2.0, =5.2.0, =5.2.0, =5.2.4 and more Source...

kalenis-user-view (>=5.4.0, <=5.4.4), mds-account-de-skr04 (5.4.0) +147 more potentially affected by CVE-2025-66422 via trytond (5.4.20)

trytond PYPI version 5.4.20 is affected by a known vulnerability. The following packages have a transitive dependency on trytond and may be impacted: - kalenis-user-view =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.1 and more Source cves:...

kalenis-user-view (>=5.6.0, <=5.6.4), trytoncalidae-authentication-dummy (5.6.0) +147 more potentially affected by CVE-2025-66422 via trytond (5.6.17)

trytond PYPI version 5.6.17 is affected by a known vulnerability. The following packages have a transitive dependency on trytond and may be impacted: - kalenis-user-view =5.6.0, =5.6.0, =5.6.0, =5.6.0, =5.6.0, =5.6.0, =5.6.0, =5.6.0, =5.6.0, =5.6.0, =5.6.0, =5.6.0, =5.6.0, =5.6.0, =5.6.1 and more...

trytoncalidae-authentication-dummy (5.8.0), trytond-account (>=5.8.0, <=5.8.6) +152 more potentially affected by CVE-2025-66422 via trytond (5.8.16)

trytond PYPI version 5.8.16 is affected by a known vulnerability. The following packages have a transitive dependency on trytond and may be impacted: - trytoncalidae-authentication-dummy 5.8.0 - trytond-account =5.8.0, =5.8.0, =5.8.0, =5.8.0, =5.8.0, =5.8.0, =5.8.0, =5.8.0, =5.8.0, =5.8.0, =5.8.0...

akademy-classe (>=1.1.0, <=1.1.5), akademy-classe-evaluation (>=1.3.0, <=1.3.1) +5 more potentially affected by CVE-2025-66424 via trytond (7.0.0)

trytond PYPI version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on trytond and may be impacted: - akademy-classe =1.1.0, =1.3.0, =1.1.0, =1.1.0, =1.0.0, =1.0.0, =1.1.0, =7.0.0 Source cves: CVE-2025-66424 Source advisory: OSV:PYSEC-2026-1989...

akademy-classe (>=1.1.0, <=1.1.5), akademy-classe-evaluation (>=1.3.0, <=1.3.1) +5 more potentially affected by CVE-2025-66422 via trytond (7.0.0)

trytond PYPI version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on trytond and may be impacted: - akademy-classe =1.1.0, =1.3.0, =1.1.0, =1.1.0, =1.0.0, =1.0.0, =1.1.0, =7.0.0 Source cves: CVE-2025-66422 Source advisory: OSV:PYSEC-2026-1990...

akademy-classe (>=1.1.0, <=1.1.5), akademy-classe-evaluation (>=1.3.0, <=1.3.1) +5 more potentially affected by CVE-2025-66423 via trytond (7.0.0)

trytond PYPI version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on trytond and may be impacted: - akademy-classe =1.1.0, =1.3.0, =1.1.0, =1.1.0, =1.0.0, =1.0.0, =1.1.0, =7.0.0 Source cves: CVE-2025-66423 Source advisory: OSV:PYSEC-2026-1991...

trytoncalidae-authentication-dummy (7.2.0), trytoncalidae-jinja-report (>=7.2.0, <=7.2.1) +211 more potentially affected by CVE-2025-66424 via trytond (7.2.23)

trytond PYPI version 7.2.23 is affected by a known vulnerability. The following packages have a transitive dependency on trytond and may be impacted: - trytoncalidae-authentication-dummy 7.2.0 - trytoncalidae-jinja-report =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0,...