CVE-2025-66422: Tryton Trytond Information Disclosure Flaw

CVE-2025-66422 Overview

CVE-2025-66422 is an information disclosure vulnerability in Tryton trytond, the server component of the Tryton open-source business application platform. Remote authenticated attackers with low privileges can trigger error conditions that expose sensitive traceback data, including server setup and internal configuration details. The flaw affects all trytond releases prior to 7.6.11, with backported fixes released for the 7.4, 7.0, and 6.0 branches. The issue is classified as [CWE-402: Transmission of Private Resources into a New Sphere (Resource Leak)].

Critical Impact
Attackers can harvest traceback and server-setup details to map internal application structure and stage follow-on attacks against Tryton deployments.

Affected Products

Tryton trytond versions prior to 7.6.11
Tryton trytond 7.4.x prior to 7.4.21 and 7.0.x prior to 7.0.40
Tryton trytond 6.0.x prior to 6.0.70

Discovery Timeline

2025-11-30 - CVE-2025-66422 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66422

Vulnerability Analysis

The vulnerability resides in the trytond server request handling path. When certain requests fail, the server returns traceback information that includes server setup details rather than a sanitized error response. An authenticated remote user with low privileges can trigger these code paths and read the resulting data.

The disclosed content reveals internal implementation details such as module names, file paths, and configuration state. This information supports reconnaissance for privilege escalation, injection, or targeted logic attacks against the Tryton deployment. The issue affects confidentiality only; integrity and availability are not impacted according to the published CVSS vector.

Maintainers addressed the flaw in trytond versions 7.6.11, 7.4.21, 7.0.40, and 6.0.70. Refer to the Tryton Security Release Announcement and Heptapod Issue #14354 Details for maintainer notes.

Root Cause

The server exposes raw traceback content to authenticated clients when specific error paths execute. Error responses were not sufficiently sanitized before being returned over the network, producing an unintended sensitive information leak.

Attack Vector

Exploitation requires network access to the trytond server and valid low-privilege credentials. No user interaction is needed. An attacker submits crafted requests that trigger server-side errors and then parses the returned traceback for server setup information.

// No verified public proof-of-concept is available.
// See the Tryton security release announcement and Heptapod issue #14354
// for maintainer-authored technical details.

Detection Methods for CVE-2025-66422

Indicators of Compromise

Repeated authenticated requests from a single account that produce HTTP 500 or application-level error responses from trytond.
Server log entries containing Python traceback output correlated with client requests over short time windows.
Unusual enumeration patterns targeting Tryton RPC or JSON-RPC endpoints from a single session.

Detection Strategies

Inventory Tryton deployments and identify trytond instances running versions older than 7.6.11, 7.4.21, 7.0.40, or 6.0.70.
Enable verbose access logging on the trytond server and web proxy, then alert on spikes in error responses per authenticated user.
Correlate authentication logs with error responses to identify accounts probing for traceback disclosure.

Monitoring Recommendations

Forward trytond and reverse-proxy logs to a centralized analytics platform for retention and query.
Baseline normal error rates per user and endpoint, then alert on statistically significant deviations.
Monitor for outbound egress of large volumes of application error content from Tryton hosts.

How to Mitigate CVE-2025-66422

Immediate Actions Required

Upgrade trytond to 7.6.11, 7.4.21, 7.0.40, or 6.0.70 depending on the deployed branch.
Audit user accounts on Tryton and revoke or rotate credentials for accounts showing anomalous error-triggering activity.
Restrict network exposure of the trytond server so only trusted clients can reach it.

Patch Information

The Tryton maintainers released fixed versions 7.6.11, 7.4.21, 7.0.40, and 6.0.70. Patch and release details are documented in the Tryton Security Release Announcement and tracked in Heptapod Issue #14354 Details.

Workarounds

Place trytond behind a reverse proxy that rewrites 5xx responses and strips traceback content before returning them to clients.
Limit authenticated access to trusted internal networks or VPN clients until patches are applied.
Review Tryton role assignments and remove unnecessary low-privilege accounts that could be abused to trigger the flaw.

bash

# Example: upgrade trytond using pip to a fixed release
pip install --upgrade "trytond==7.6.11"

# For 7.4.x, 7.0.x, or 6.0.x deployments, pin to the fixed branch release
# pip install --upgrade "trytond==7.4.21"
# pip install --upgrade "trytond==7.0.40"
# pip install --upgrade "trytond==6.0.70"