CVE-2018-14886
The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privi…
Published Jun 28, 2019 · updated Jun 17, 2026 · odoo odoo
The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description.
Timeline
Detection, updates, and resolution for this record.
Jun 28, 2019 · Catalog
Detected
The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description.
Jun 16, 2026 · Catalog
Updated
The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description.
Jun 17, 2026 · NIST NVD
Updated
The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description.
Affected
- cpe odoo/odoo10.0
- cpe odoo/odoo11.0
- cpe odoo/odoo9.0
Sources
- CVE.orgCVE-2018-14886
Official CVE identifier
cve.org - FIRST EPSSCVE-2018-14886
30-day exploitation probability 1.3%
first.org - NIST NVDCVE-2018-14886
The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description.
nvd.nist.gov - Odoo SecurityCVE-2018-14886
Odoo or OpenERP product vulnerability. Vendor discussion stays on the Odoo tracker.
github.com