CVE-2021-23166 Path traversal in Odoo Community
Authenticated administrators can bypass sandboxing to read and write local files on the Odoo server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-23166?
CVE-2021-23166 is a high-severity path traversal vulnerability in Odoo Odoo, published on 25 Apr 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and write local files on the server.
Which versions are affected by CVE-2021-23166?
1 open source package ship an affected version, including odoo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
odoo Bitnami | All versions | 15.0.1 |
Products include Odoo Odoo.
How do I fix CVE-2021-23166?
Upgrade odoo to 15.0.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-23166 being exploited?
There is no known exploitation of CVE-2021-23166 in the wild and no public exploit code.
Other vulnerabilities in Odoo Odoo
Sources
Also known as BIT-odoo-2021-23166, DEBIAN-CVE-2021-23166, GHSA-7pm2-436m-jff6, UBUNTU-CVE-2021-23166.