# Security Release for issue #14947
**URL:** https://discuss.tryton.org/t/security-release-for-issue-14947/9302
**Category:** News
**Created:** [August 5, 2026, 6:00am UTC](https://discuss.tryton.org/t/security-release-for-issue-14947/9302 "2026-08-05T06:00:46Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [August 5, 2026, 6:00am UTC](https://discuss.tryton.org/t/security-release-for-issue-14947/9302/1 "2026-08-05T06:00:46Z")
[Cédric Krier](https://foss.heptapod.net/ced) has discovered that [Tryton does not prevent weasyprint to access local files](https://bugs.tryton.org/14947) when rendering HTML report to PDF.
## Impact
[CVSS v3.0 Base Score: 4.9](https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C)
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Confidentiality: High
- Integrity: None
- Availability: None
## Workaround
There is no workaround.
## Resolution
All affected users should upgrade `trytond` to the latest version.
Affected versions per series:
- `trytond`:
- 8.0: \<= 8.0.7
- 7.8: \<= 7.8.13
- 7.0: \<= 7.0.54
Not affected versions per series:
- `trytond`:
- 8.0: \>= 8.0.8
- 7.8: \>= 7.8.14
- 7.0: \>= 7.0.55
_Some custom reports may fail after the upgrade because they are using local files. Such reports must be updated to use only files via public HTTP._
## Reference
- [https://bugs.tryton.org/14947](https://bugs.tryton.org/14947)
## Concerns?
Any security concerns should be reported on the bug-tracker at [https://bugs.tryton.org/](https://bugs.tryton.org/) with the confidential checkbox checked.
---
### Author:  [@system](https://discuss.tryton.org/u/system)
#### Post date: [September 4, 2026, 6:00am UTC](https://discuss.tryton.org/t/security-release-for-issue-14947/9302/2 "2026-09-04T06:00:52Z")
This topic was automatically closed after 30 days. New replies are no longer allowed.