CVE-2022-26661

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-26661
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-26661.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-26661
Aliases
Downstream
Published
2022-03-10T17:47:52.213Z
Modified
2026-02-16T07:48:15.258462Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.

References

Affected packages

Git / github.com/python-pillow/pillow

Affected ranges

Type
GIT
Repo
https://github.com/python-pillow/pillow
Events
Introduced
8a30d135378dc6a1c3c08fa4bb9fbc15370feedf
Fixed
a45c8583ff90312a2fddc38567ed736cef4af563

Affected versions

6.*
6.2.0
6.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-26661.json"

Git / github.com/tryton/trytond

Affected ranges

Type
GIT
Repo
https://github.com/tryton/trytond
Events
Introduced
49399603b2eb8d9516df84e3a3855c885fcf9fc5
Fixed
0b39f8e629658f8276a1ee9a4aebd5cd85dd8805
Introduced
49721b4fecac6b47dd833ec59e0f4d7bcc1f99d5
Fixed
5ae4e1f9d03d63f0bfa4ea535d3398284df97822
Introduced
b68fa47ada63616d6d0d37118a9417d72d62468d
Fixed
6d8d5ae0745f54e1775e710347c36576699dbd02

Affected versions

5.*
5.0.0
5.0.1
5.0.10
5.0.11
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.2.0
5.4.0
5.6.0
5.8.0
6.*
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.2.0
6.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-26661.json"