Executive brief
Improper Restriction of XML External Entity Reference in trytond and proteus
Affected products
- PyPI proteus
- PyPI tryton
- PyPI trytond
Junglewise Threat Intelligence
CVE-2022-26661: PYSEC-2026-740 - Improper Restriction of XML External Entity Reference in trytond and proteus
CVE-2022-26661 · Severity: low · CVSS 3.1 · Published 2026-07-02
Technologies: tryton (PyPI), trytond (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-3390 - Tryton vulnerable to arbitrary command execution
- PYSEC-2026-1989 - trytond does not enforce access rights for data export
- PYSEC-2026-1990 - trytond allows remote attackers to obtain sensitive trace-back (server setup) information
- PYSEC-2026-1991 - trytond does not enforce access rights for the route of the HTML editor.
- PYSEC-2026-1054 - Tryton Directory Traversal vulnerability