CVE-2022-26662 json
XML Entity Expansion in trytond and proteus
published 2022-03-07 4 y ago modified 2026-07-13 3 mo ago also GHSA-pm3h-mm62-pwm8 , PYSEC-2022-43171 , PYSEC-2026-3392 , PYSEC-2026-741 , EUVD-2022-0343
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.0%
- EPSS 2.0% chance of exploitation in 30 days, percentile 80%
- public exploits
- 0
- none known
Summary
An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.
Patch / fix
- pypi trytond 5.0.46, 6.0.16, 6.2.6
- pypi proteus 5.0.12, 6.0.5, 6.2.2
- pypi tryton 5.0.12, 5.0.46, 6.0.5, 6.0.16, 6.2.2, 6.2.6
- tryton proteus 5.0.12, 6.0.5, 6.2.2
- tryton trytond 5.0.46, 6.0.16, 6.2.6
- tryton-server Debian 14, Debian 13, Debian 12 6.0.16-1
- tryton-proteus Debian 14, Debian 13, Debian 12 6.0.5-1
debian advisories DEBIAN-CVE-2022-26662
- bugs.tryton.org/issue11244 advisory
Exploit prediction
1.97% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | trytond | >=5.0.0, <5.0.46 >=6.0.0, <6.0.16 >=6.1.0, <6.2.6 |
5.0.46 6.0.16 6.2.6 |
| pypi | proteus | >=5.0.0, <5.0.12 >=6.0.0, <6.0.5 >=6.1.0, <6.2.2 |
5.0.12 6.0.5 6.2.2 |
| pypi | tryton | >=5.0.0, <5.0.12 >=6.0.0, <6.0.5 >=6.2.0, <6.2.2 <6.2.6 <6.0.16 <5.0.46 |
5.0.12 6.0.5 6.2.2 6.2.6 6.0.16 5.0.46 |
Classification
- Weakness
-
- CWE-776 Improper Restriction of Recursive Entity References in DTDs
References
-
bugs.tryton.org
/issue11244
web, patch, vendor-advisory, advisory
-
debian.org
/security/2022/dsa-5098
vendor-advisory, web, third-party-advisory, advisory
-
debian.org
/security/2022/dsa-5099
vendor-advisory, web, third-party-advisory, advisory
-
discuss.tryton.org
/t/security-release-for-issue11219-and-issue11244/5059
web, vendor-advisory, advisory
-
lists.debian.org
/debian-lts-announce/2022/03/msg00016.html
mailing-list, web, third-party-advisory
-
lists.debian.org
/debian-lts-announce/2022/03/msg00017.html
mailing-list, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-26662
advisory
-
hg.tryton.org
/trytond
package
-
pypi.org
/project/proteus
package
-
github.com
/advisories/GHSA-pm3h-mm62-pwm8
advisory
-
pypi.org
/project/trytond
package
Sources
- CVE List CVE-2022-26662
- GitHub Advisory GHSA-pm3h-mm62-pwm8
- NVD CVE-2022-26662
- OSV PYSEC-2022-43171
- OSV PYSEC-2026-741
- OSV PYSEC-2026-3392
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.