CVE-2025-66422
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Tryton trytond before version 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in versions 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
Risk Assessment
An attacker could obtain server configuration information, which may aid further attacks and compromise system security.
Recommendation
Update Tryton trytond to one of the specified versions that include a security fix.
Other vulnerabilities in Tryton trytond
See all- CVE-2025-66424Medium
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
- CVE-2025-66423High
Tryton trytond versions 6.0 through before 7.6.11 do not enforce access rights for the HTML editor route. This is fixed in versions 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
Original NVD description (English source)
Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS