# Security Release for issue #5160 and #14869

**URL:** https://discuss.tryton.org/t/security-release-for-issue-5160-and-14869/9266
**Category:** News
**Tags:** security
**Created:** [July 3, 2026, 6:00am UTC](https://discuss.tryton.org/t/security-release-for-issue-5160-and-14869/9266 "2026-07-03T06:00:50Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![ced](https://discuss-cdn.tryton.org/user_avatar/discuss.tryton.org/ced/32/1237_2.png) [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [July 3, 2026, 6:00am UTC](https://discuss.tryton.org/t/security-release-for-issue-5160-and-14869/9266/1 "2026-07-03T06:00:50Z")

</div>

The user titou has discovered that [the administrator group can execute Python code on the server which is hidden inside an uploaded report template](https://bugs.tryton.org/5160).  
And [Dan Shallom](https://foss.heptapod.net/dan.shallom) has discovered that [the same can also be accomplished by the marketing group when uploading marketing email templates](https://bugs.tryton.org/14869).

## Impact

[CVSS v3.0 Base Score: 6.5](https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C)

- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Confidentiality: High
- Integrity: None
- Availability: None

## Workaround

There is no workaround.

## Resolution

All affected users should upgrade `trytond` to the latest version.

Affected versions per series:

- `trytond`:
  - 8.0: \<= 8.0.5
  - 7.8: \<= 7.8.11
  - 7.0: \<= 7.0.52

Not affected versions per series:

- `trytond`:
  - 8.0: \>= 8.0.6
  - 7.8: \>= 7.8.12
  - 7.0: \>= 7.0.53

_Some custom reports may fail after the upgrade because they are using dynamic or private attributes. Such reports must be updated to use only the allowed statements._

## Reference

- [Report customisation (#5160) · Issues · Tryton / Tryton · GitLab](https://bugs.tryton.org/5160)
- [Remote Code Execution via Template Injection (#14869) · Issues · Tryton / Tryton · GitLab](https://bugs.tryton.org/14869)

## Concerns?

Any security concerns should be reported on the bug-tracker at [https://bugs.tryton.org/](https://bugs.tryton.org/) with the confidential checkbox checked.

---

<div class="post-metadata">

### Author: ![acaubet](https://discuss-cdn.tryton.org/user_avatar/discuss.tryton.org/acaubet/32/1493_2.png) [@acaubet](https://discuss.tryton.org/u/acaubet)
#### Post date: [July 3, 2026, 8:14am UTC](https://discuss.tryton.org/t/security-release-for-issue-5160-and-14869/9266/2 "2026-07-03T08:14:47Z")

</div>

FTR, one of the commits is about [restricting Genshi evaluation](https://foss.heptapod.net/tryton/tryton/-/commit/101aaf12c6bb), so make sure to check your reports. They will now fail with `UndefinedError: "X" not defined` if they use anything outside the [allowed built-ins](https://foss.heptapod.net/tryton/tryton/-/blob/52faa4f70a4769ec80560b5b9e2b4eec0a94e267/trytond/trytond/_safe_genshi.py#L40) like `getattr`.

---

<div class="post-metadata">

### Author: ![acaubet](https://discuss-cdn.tryton.org/user_avatar/discuss.tryton.org/acaubet/32/1493_2.png) [@acaubet](https://discuss.tryton.org/u/acaubet)
#### Post date: [July 3, 2026, 11:13am UTC](https://discuss.tryton.org/t/security-release-for-issue-5160-and-14869/9266/3 "2026-07-03T11:13:53Z")

</div>

FTR, some reports on Tryton [use those build-ins so they are already failing](https://foss.heptapod.net/tryton/tryton/-/work_items/14929).

---

<div class="post-metadata">

### Author: ![system](https://discuss-cdn.tryton.org/uploads/default/original/1X/c6f8ec0a40525cdcd50058c734283450a4b3d38b.png) [@system](https://discuss.tryton.org/u/system)
#### Post date: [August 2, 2026, 6:01am UTC](https://discuss.tryton.org/t/security-release-for-issue-5160-and-14869/9266/4 "2026-08-02T06:01:08Z")

</div>

This topic was automatically closed after 30 days. New replies are no longer allowed.