CVE-2018-14886
The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privi…
Published Jun 28, 2019 · updated Jun 16, 2026 · odoo odoo
The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description.
Timeline
Detection, updates, and resolution for this record.
Jun 28, 2019 · Catalog
Detected
The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description.
Jun 16, 2026 · Catalog
Updated
The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description.
Affected
- cpe odoo/odoo10.0
- cpe odoo/odoo11.0
- cpe odoo/odoo9.0
Sources
- NIST NVDCVE-2018-14886
The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description.
nvd.nist.gov - Odoo SecurityCVE-2018-14886
Odoo or OpenERP product vulnerability. Vendor discussion stays on the Odoo tracker.
github.com