PT-2026-21846 · Inventree · Inventree

Byamb4

·

Published

2026-02-25

·

Updated

2026-04-08

·

CVE-2026-27629

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions InvenTree versions prior to 1.2.3
Description InvenTree is an Open Source Inventory Management System. Prior to version 1.2.3, insecure server-side templates can be hijacked to expose secure information to the client. When generating custom batch codes, the InvenTree server uses a customizable jinja2 template, which can be modified by a staff user to exfiltrate sensitive information or perform code execution on the server. This issue requires access by a user with staff permissions, followed by a request to generate a custom batch code via the API. Once the template has been modified maliciously, the API call to generate a new batch code could be made by other users, and the template code will be executed with their user context. The batch code template is a configurable global setting which can be adjusted by any user with staff access. The vulnerable API endpoint is used to generate a new batch code. The vulnerable parameters are those used to customize the jinja2 template.
Recommendations For InvenTree installations prior to 1.2.3, the STOCK BATCH CODE TEMPLATE and PART NAME FORMAT global settings should be overridden at the system level to prevent editing.

Exploit

Fix

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2026-27629
GHSA-CX85-VR3Q-9X4M

Affected Products

Inventree