CVE-2025-66422 trytond allows remote attackers to obtain sensitive trace-back (server setup) information

Medium 4.3 Published 30 Nov 2025 Updated 1 Dec 2025

Remote attackers can obtain sensitive server setup information via traceback exposure in Tryton trytond, requiring an upgrade to secure the system.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-66422?

CVE-2025-66422 is a medium-severity vulnerability in trytond, published on 30 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.

Weakness: CWE-402

Which versions are affected by CVE-2025-66422?

9 open source packages ship an affected version, including trytond. It affects 1 product.

Package	Affected	Fixed in
`trytond` PyPI	All versions	`6.0.70, 7.0.40, 7.4.21, 7.6.11`
`trytond` PyPI	All versions	`6.0.70`
`trytond` PyPI	All versions	`6.0.70`
`trytond` PyPI	From `7.0.0`	`7.0.40`
`trytond` PyPI	From `7.0.0`	`7.0.40`
`trytond` PyPI	From `7.1.0`	`7.4.21`

3 more packages

`trytond` PyPI	From `7.1.0`	`7.4.21`
`trytond` PyPI	From `7.5.0`	`7.6.11`
`trytond` PyPI	From `7.5.0`	`7.6.11`

Products include Tryton Trytond.

How do I fix CVE-2025-66422?

Upgrade trytond to a fixed version for your release line: 6.0.70, 7.0.40, 7.4.21 or 7.6.11.

Is CVE-2025-66422 being exploited?

There is no known exploitation of CVE-2025-66422 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2025-66422, GHSA-jqfc-9q34-prhg, PYSEC-2026-1990, UBUNTU-CVE-2025-66422.