Read the docs
TI-2022-09934 Aliases CVE-2022-26661GHSA-cj78-rgw3-4h5p

An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45…

Priority LOW 32CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-611 and the CVSS impact.

Summary

An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.

Why it matters now

EPSS 0.01407 72nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed trytond (PyPI): 5.0.46, 6.0.16, 6.2.6proteus (PyPI): 5.0.12, 6.0.5, 6.2.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—trytond (PyPI)5.0.0 to before 5.0.465.0.46Patch availableGHSA-cj78-rgw3-4h5p
—trytond (PyPI)6.0.0 to before 6.0.166.0.16Patch availableGHSA-cj78-rgw3-4h5p
—trytond (PyPI)6.1.0 to before 6.2.66.2.6Patch availableGHSA-cj78-rgw3-4h5p
—proteus (PyPI)5.0.0 to before 5.0.125.0.12Patch availableGHSA-cj78-rgw3-4h5p
—proteus (PyPI)6.0.0 to before 6.0.56.0.5Patch availableGHSA-cj78-rgw3-4h5p
—proteus (PyPI)6.1.0 to before 6.2.26.2.2Patch availableGHSA-cj78-rgw3-4h5p
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • trytond (PyPI) Vendor— Affected 5.0.0 to before 5.0.46 Fixed in 5.0.46 Patch available GHSA-cj78-rgw3-4h5p
  • trytond (PyPI) Vendor— Affected 6.0.0 to before 6.0.16 Fixed in 6.0.16 Patch available GHSA-cj78-rgw3-4h5p
  • trytond (PyPI) Vendor— Affected 6.1.0 to before 6.2.6 Fixed in 6.2.6 Patch available GHSA-cj78-rgw3-4h5p
  • proteus (PyPI) Vendor— Affected 5.0.0 to before 5.0.12 Fixed in 5.0.12 Patch available GHSA-cj78-rgw3-4h5p
  • proteus (PyPI) Vendor— Affected 6.0.0 to before 6.0.5 Fixed in 6.0.5 Patch available GHSA-cj78-rgw3-4h5p
  • proteus (PyPI) Vendor— Affected 6.1.0 to before 6.2.2 Fixed in 6.2.2 Patch available GHSA-cj78-rgw3-4h5p

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:tryton:proteus:*:*:*:*:*:*:*:*5.0.0 to before 5.0.12; 6.0.0 to before 6.0.5; 6.2.0 to before 6.2.2VulnerableTryton
cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*5.0.0 to before 5.0.46; 6.0.0 to before 6.0.16; 6.2.0 to before 6.2.6VulnerableTryton
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:tryton:proteus:*:*:*:*:*:*:*:* Versions 5.0.0 to before 5.0.12; 6.0.0 to before 6.0.5; 6.2.0 to before 6.2.2 Vulnerable ·Tryton
  • cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:* Versions 5.0.0 to before 5.0.46; 6.0.0 to before 6.0.16; 6.2.0 to before 6.2.6 Vulnerable ·Tryton
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-cj78-rgw3-4h5p trytond (PyPI) Fixed in 5.0.46 Advisory →
  • Fix · GHSA-cj78-rgw3-4h5p trytond (PyPI) Fixed in 6.0.16 Advisory →
  • Fix · GHSA-cj78-rgw3-4h5p trytond (PyPI) Fixed in 6.2.6 Advisory →
  • Fix · GHSA-cj78-rgw3-4h5p proteus (PyPI) Fixed in 5.0.12 Advisory →
  • Fix · GHSA-cj78-rgw3-4h5p proteus (PyPI) Fixed in 6.0.5 Advisory →
  • Fix · GHSA-cj78-rgw3-4h5p proteus (PyPI) Fixed in 6.2.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-26661
  2. 2026-10-03 Alias added: GHSA-cj78-rgw3-4h5p

References

Exploit 1

Advisory 6

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences