Wkhtmltopdf · Wkhtmltopdf · CVE-2018-14865
**Name of the Vulnerable Software and Affected Versions**
Odoo Community versions 9.0 through 11.0
Odoo Enterprise versions 9.0 through 11.0
**Description**
The report engine in Odoo does not use secure options when passing documents to wkhtmltopdf, allowing remote attackers to read local files.
**Recommendations**
For Odoo Community versions 9.0 through 11.0, consider updating to a version that uses secure options when passing documents to wkhtmltopdf.
For Odoo Enterprise versions 9.0 through 11.0, consider updating to a version that uses secure options when passing documents to wkhtmltopdf.
As a temporary workaround, consider restricting access to the report engine until a secure version is available.