Executive brief
trytond does not enforce access rights for the route of the HTML editor.
Affected products
- PyPI trytond
Junglewise Threat Intelligence
CVE-2025-66423: PYSEC-2026-1991 - trytond does not enforce access rights for the route of the HTML editor.
CVE-2025-66423 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: trytond (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-3390 - Tryton vulnerable to arbitrary command execution
- PYSEC-2026-1989 - trytond does not enforce access rights for data export
- PYSEC-2026-1990 - trytond allows remote attackers to obtain sensitive trace-back (server setup) information
- PYSEC-2026-1054 - Tryton Directory Traversal vulnerability
- PYSEC-2026-741 - XML Entity Expansion in trytond and proteus