CVE-2021-44476

What it actually does

Authenticated administrators can bypass sandbox restrictions to perform path traversal and read arbitrary local files including configuration data.

Why it matters to the business

Compromise of sensitive server configuration and data by privileged insiders or compromised admin accounts, increasing risk of further system access or data exposure.

How an attack unfolds

An attacker obtains administrator credentials, then submits specially crafted requests that exploit insufficient path validation in the sandbox to traverse directories and retrieve restricted files.

How to fix it

Upgrade Odoo Community or Enterprise to a version later than 15.0 that resolves the sandbox path validation issue; restrict administrator privileges and monitor file access patterns until patches are applied.

How to confirm the fix worked

Review release notes for sandboxing fixes after version 15.0, test admin access attempts against known sensitive paths to confirm blocking, and audit configuration file permissions.

Typical attack path

1. Obtain valid administrator credentials
2. Identify endpoints lacking path sanitization
3. Craft requests containing directory traversal sequences
4. Read and exfiltrate targeted local files

How to detect it

Examine web server and application logs for requests containing path traversal sequences from authenticated admin sessions; correlate with access to sensitive configuration file paths.

What your security team should do

• Prioritize upgrade of all Odoo 15.0 and earlier instances to patched releases
• Limit administrative accounts to least privilege and enable enhanced logging for file operations
• Scan for exposed configuration files and rotate any secrets found in them