PT-2025-23674 · Inventree · Inventree

Schrodingersgat · Published 2025-06-03 · Updated 2025-12-17 · CVE-2025-49000

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions InvenTree versions prior to 0.17.13

Description The issue affects the built-in label-sheet plugin, where the skip field lacks an upper bound. This allows any authenticated label-printing user to trigger a denial-of-service via memory exhaustion by providing a large value, forcing the server to allocate an enormous Python list.

Recommendations For versions prior to 0.17.13, upgrade to version 0.17.13 or higher to resolve the issue. At the moment, there is no workaround available aside from upgrading to the patched version.

Exploit

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2025-49000

GHSA-M2CH-H84R-P9R6

Affected Products

Inventree

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49000.json · Exploit
• https://github.com/inventree/InvenTree/security/advisories/GHSA-m2ch-h84r-p9r6 · Vendor Advisory
• https://github.com/inventree/InvenTree/commit/0826a75ef6dde0ad96d680f52a9cf171ba2ce98b · Patch
• https://osv.dev/vulnerability/CVE-2025-49000 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49000 · Security Note
• https://github.com/inventree/InvenTree/releases/tag/0.17.13 · Note
• https://twitter.com/CVEnew/status/1930010218793963935 · Twitter Post
• https://t.me/cveNotify/146094 · Telegram Post
• https://t.me/cvetracker/25324 · Telegram Post