--- title: Security Release for issue #14947 | daily.dev description: A security vulnerability has been discovered in Tryton (trytond) where weasyprint is not prevented from accessing local files when rendering HTML reports to... canonical: https://daily.dev/posts/security-release-for-issue-14947-nvubxdqjv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Security Release for issue #14947 | daily.dev og:description: A security vulnerability has been discovered in Tryton (trytond) where weasyprint is not prevented from accessing local files when rendering HTML reports to... og:url: https://daily.dev/posts/security-release-for-issue-14947-nvubxdqjv og:image: https://api.daily.dev/og/posts/NVubxDqJV.png og:image:alt: Security Release for issue #14947 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Security Release for issue #14947 **[Planet Python](https://daily.dev/sources/planetpython)** · 1 min read · 0 upvotes · 0 comments ## Summary A security vulnerability has been discovered in Tryton (trytond) where weasyprint is not prevented from accessing local files when rendering HTML reports to PDF. The flaw carries a CVSS v3.0 base score of 4.9, with a network attack vector, low complexity, but requiring high privileges. There is no workaround — all affected users must upgrade trytond to versions 8.0.8, 7.8.14, or 7.0.55 or later depending on their series. Note that custom reports relying on local files may break after the upgrade and will need to be updated to use public HTTP URLs instead. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Tryton Release 8.2](https://daily.dev/posts/tryton-release-8-2-br9lovowk) · Planet Python · 0 upvotes · 0 comments - [Tryton News July 2026](https://daily.dev/posts/tryton-news-july-2026-8naybu1lu) · Planet Python · 0 upvotes · 0 comments - [Critical jsPDF vulnerability enables arbitrary file read in Node.js deployments](https://daily.dev/posts/critical-jspdf-vulnerability-enables-arbitrary-file-read-in-node-js-deployments-zhc6utwik) · CSO Online · 0 upvotes · 0 comments - [Django security releases issued: 6.0.2, 5.2.11, and 4.2.28](https://daily.dev/posts/django-security-releases-issued-6-0-2-5-2-11-and-4-2-28-vipyydhxs) · Django · 0 upvotes · 0 comments - [Ivanti: Max severity Sentry flaw allows code execution as root](https://daily.dev/posts/ivanti-max-severity-sentry-flaw-allows-code-execution-as-root-h8hixzuel) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python) [View this post on daily.dev](https://daily.dev/posts/security-release-for-issue-14947-nvubxdqjv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Security Release for issue #14947","url":"https://daily.dev/posts/security-release-for-issue-14947-nvubxdqjv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/security-release-for-issue-14947-nvubxdqjv"},"datePublished":"2026-08-05T07:51:17.649Z","dateModified":"2026-08-05T07:51:38.960Z","description":"A security vulnerability has been discovered in Tryton (trytond) where weasyprint is not prevented from accessing local files when rendering HTML reports to...","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"Planet Python","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Planet Python","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/eac3cc584cb043b5a242d13752bd3d0c","url":"https://daily.dev/sources/planetpython"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/security-release-for-issue-14947-nvubxdqjv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,python","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Planet Python","item":"https://daily.dev/sources/planetpython"},{"@type":"ListItem","position":3,"name":"Security Release for issue #14947"}]} ```