CVE-2022-26661: Debian Linux

Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days.

An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
• Tryton Proteus: from 5.0.0, before 5.0.12 (fixed in 5.0.12); from 6.0.0, before 6.0.5 (fixed in 6.0.5); from 6.2.0, before 6.2.2 (fixed in 6.2.2)
• Tryton Trytond: from 5.0.0, before 5.0.46 (fixed in 5.0.46); from 6.0.0, before 6.0.16 (fixed in 6.0.16); from 6.2.0, before 6.2.6 (fixed in 6.2.6)

Published 2022-03-10. Last modified 2026-06-17.