CVE-2021-45071

What it actually does

Allows arbitrary JavaScript injection into victim browsers through unsanitized file names during upload handling, resulting in reflected or stored script execution under the Odoo web application's origin.

Why it matters to the business

Attackers can steal session tokens, perform unauthorized actions on behalf of users, or exfiltrate sensitive business data stored in the Odoo instance, increasing risk of account compromise and data exposure across organizations using the platform.

How an attack unfolds

An attacker crafts an upload file name containing HTML or JavaScript payloads, submits it through any file upload feature in Odoo, and then lures a victim user into viewing the file listing or related record where the payload executes in the browser context.

How to fix it

Upgrade Odoo Community and Enterprise to a version later than 15.0 that contains the upstream fix for filename sanitization; alternatively apply vendor security patches or implement server-side filename validation and output encoding on all file metadata displays.

How to confirm the fix worked

Confirm the currently running Odoo version is newer than 15.0, review file upload and display code paths for proper escaping of filenames, and test upload of files containing script tags to verify they are rendered as plain text.

Typical attack path

1. Identify an Odoo instance and a file upload endpoint that displays file metadata
2. Upload a file whose name contains a script payload or event handler
3. Induce a victim user or administrator to browse to the affected record or file list view
4. Execute arbitrary actions in the victim's session such as data theft or privilege abuse

How to detect it

Search web server and Odoo application logs for file upload requests containing suspicious filename patterns such as angle brackets, event handlers, or encoded script fragments; inspect audit trails for unexpected file metadata entries and correlate with user session activity.

• filenames containing <script
• filenames containing onerror=
• filenames containing javascript:
• upload requests returning 200 with payload-like names in access logs

What your security team should do

• Prioritize upgrade of all Odoo instances to a patched release as soon as possible given the public disclosure
• Review and restrict file upload permissions to the minimum required roles
• Enable Content-Security-Policy headers with strict script-src directives to limit XSS impact
• Monitor for unusual file names or upload activity in application logs