CVE-2025-66422
Medium · 4.3trytond allows remote attackers to obtain sensitive trace-back (server setup) information
CVSS
4.3
EPSS
0.3%
Published
Nov 30, 2025
CISA due date
—
The record
Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | trytond | 0 | 6.0.70 |
| PyPI | trytond | 7.0.0 | 7.0.40 |
| PyPI | trytond | 7.1.0 | 7.4.21 |
| PyPI | trytond | 7.5.0 | 7.6.11 |
| pypi | trytond | 7.0.0 | No fix |
| pypi | trytond | 7.1.0 | No fix |
| pypi | trytond | 7.5.0 | No fix |
Related vulnerabilities
- CVE-2025-66423 trytond does not enforce access rights for the route of the HTML editor. Also affects trytond
- CVE-2025-66424 trytond does not enforce access rights for data export Also affects trytond
- CVE-2025-67745 MyHoard is a daemon for creating, managing and restoring MySQL backups. CWE-402
- CVE-2026-38739 ezsystems/ezpublish-legacy has a SQL injection in dfscleanup CWE-937
- CVE-2026-47121 Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta CWE-937
- CVE-2026-47255 AgenticMail API/storage and outbound relay hardening fixes CWE-937
- CVE-2026-47122 Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections… CWE-937
- CVE-2026-47695 CC-Tweaked has an SSRF Protection Bypass with NAT64 CWE-937