# Security Release for issue10068
**URL:** https://discuss.tryton.org/t/security-release-for-issue10068/3803
**Category:** News
**Tags:** security
**Created:** [February 12, 2021, 9:30am UTC](https://discuss.tryton.org/t/security-release-for-issue10068/3803 "2021-02-12T09:30:05Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [February 12, 2021, 9:30am UTC](https://discuss.tryton.org/t/security-release-for-issue10068/3803/1 "2021-02-12T09:30:05Z")
## Synopsis
A vulnerability in [`trytond`](https://pypi.org/project/trytond/) has been found by [German Dario Alvarez](https://discuss.tryton.org/u/German).
With [issue10068](https://bugs.tryton.org/issue10068), the [WSGI](https://en.wikipedia.org/wiki/Web_Server_Gateway_Interface) server does not prevent serving files outside the root directory. This allows an attacker to retrieve the content of files for which the `trytond` user has read access.
## Impact
[CVSS v3.0 Base Score: 7.5](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality: High
- Integrity: None
- Availability: None
## Workaround
It is possible to setup a reverse-proxy in front of `trytond` that sanitize the request path.
# Resolution
All affected users should upgrade `trytond` to the latest version.
Affected versions per series:
- 5.8: \<= 5.8.3
- 5.6: \<= 5.6.12
- 5.0: \<=5.0.32
Non affected versions per series:
- 5.8: \>= 5.8.4
- 5.6: \>= 5.6.13
- 5.0: \>=5.0.33
## Reference
- [Directory loader can escape root directory (#10068) · Issues · Tryton / Tryton · GitLab](https://bugs.tryton.org/issue10068)
## Concern?
Any security concerns should be reported on the bug-tracker at [https://bugs.tryton.org/](https://bugs.tryton.org/) with the type **`security`**.
---
### Author:  [@system](https://discuss.tryton.org/u/system)
#### Post date: [March 14, 2021, 9:30am UTC](https://discuss.tryton.org/t/security-release-for-issue10068/3803/2 "2021-03-14T09:30:07Z")
This topic was automatically closed after 30 days. New replies are no longer allowed.