{"api_version":"1","generated_at":"2026-07-23T21:15:14+00:00","cve":"CVE-2022-26661","urls":{"html":"https://cve.report/CVE-2022-26661","api":"https://cve.report/api/cve/CVE-2022-26661.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-26661","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-26661"},"summary":{"title":"CVE-2022-26661","description":"An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2022-03-10 17:47:00","updated_at":"2022-03-18 14:46:00"},"problem_types":["CWE-611"],"metrics":[],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00017.html","name":"[debian-lts-announce] 20220311 [SECURITY] [DLA 2946-1] tryton-proteus security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 2946-1] tryton-proteus security update","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html","name":"[debian-lts-announce] 20220310 [SECURITY] [DLA 2945-1] tryton-server security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 2945-1] tryton-server security update","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.debian.org/security/2022/dsa-5098","name":"DSA-5098","refsource":"DEBIAN","tags":[],"title":"Debian -- Security Information -- DSA-5098-1 tryton-server","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059","name":"https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059","refsource":"MISC","tags":[],"title":"Security Release for issue11219 and issue11244 - News - Tryton Discussion","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.debian.org/security/2022/dsa-5099","name":"DSA-5099","refsource":"DEBIAN","tags":[],"title":"Debian -- Security Information -- DSA-5099-1 tryton-proteus","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://bugs.tryton.org/issue11219","name":"https://bugs.tryton.org/issue11219","refsource":"MISC","tags":[],"title":"Issue 11219: A user can read the content of files on the machine running trytond by exploiting XEE vulnerability in camt54 parsing - Tryton issue tracker","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-26661","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26661","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"26661","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"10.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"26661","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"11.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"26661","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"26661","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"tryton","cpe5":"proteus","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"26661","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"tryton","cpe5":"trytond","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2022-26661","qid":"179124","title":"Debian Security Update for tryton-server (DLA 2945-1)"},{"cve":"CVE-2022-26661","qid":"179125","title":"Debian Security Update for tryton-proteus (DLA 2946-1)"},{"cve":"CVE-2022-26661","qid":"179141","title":"Debian Security Update for tryton-server (DSA 5098-1)"},{"cve":"CVE-2022-26661","qid":"179147","title":"Debian Security Update for tryton-proteus (DSA 5099-1)"},{"cve":"CVE-2022-26661","qid":"181965","title":"Debian Security Update for tryton-servertryton-proteus (CVE-2022-26661)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2022-26661","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://bugs.tryton.org/issue11219","refsource":"MISC","name":"https://bugs.tryton.org/issue11219"},{"url":"https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059","refsource":"MISC","name":"https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059"},{"refsource":"MLIST","name":"[debian-lts-announce] 20220310 [SECURITY] [DLA 2945-1] tryton-server security update","url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html"},{"refsource":"MLIST","name":"[debian-lts-announce] 20220311 [SECURITY] [DLA 2946-1] tryton-proteus security update","url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00017.html"},{"refsource":"DEBIAN","name":"DSA-5098","url":"https://www.debian.org/security/2022/dsa-5098"},{"refsource":"DEBIAN","name":"DSA-5099","url":"https://www.debian.org/security/2022/dsa-5099"}]}},"nvd":{"publishedDate":"2022-03-10 17:47:00","lastModifiedDate":"2022-03-18 14:46:00","problem_types":["CWE-611"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:tryton:proteus:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.0.12","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:tryton:proteus:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.0.5","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:tryton:proteus:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2.0","versionEndExcluding":"6.2.2","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2.0","versionEndExcluding":"6.2.6","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.0.16","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.0.46","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}