Fig 1Attachment XSSHover to scrub · arrows stepemail in · HTML attachment
The session, carried out by the attachment's scriptSAO's preview: shows the attachment inside Tryton's own originCVE-2025-66420, one of the post's five. SAO previews an uploaded HTML attachment by rendering it inline, so its script runs in Tryton's origin with the viewer's session cookies and localStorage. With inbound_email and document_incoming enabled, the attachment can arrive by email with no login. Fixed in sao 7.6.9, 7.4.19, 7.0.38 and 6.0.67; the post does not describe the change, so only the bug is shown.