PYSEC-2026-740
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/proteus/PYSEC-2026-740.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-740
- Aliases
- Published
- 2026-07-02T14:13:15.757085Z
- Modified
- 2026-07-06T08:11:05.082705029Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- Improper Restriction of XML External Entity Reference in trytond and proteus
- Details
-
An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2022-26661
- https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059
- https://foss.heptapod.net/tryton/tryton/-/issues/11219
- https://hg.tryton.org/trytond
- https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html
- https://lists.debian.org/debian-lts-announce/2022/03/msg00017.html
- https://www.debian.org/security/2022/dsa-5098
- https://www.debian.org/security/2022/dsa-5099
- https://pypi.org/project/proteus
- https://github.com/advisories/GHSA-cj78-rgw3-4h5p
Affected packages
PyPI / proteus
Package
- Name
- proteus
- View open source insights on deps.dev
- Purl
- pkg:pypi/proteus
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced5.0.0Fixed5.0.12Introduced6.0.0Fixed6.0.5Introduced6.1.0Fixed6.2.2