PT-2026-28489 · Inventree · Inventree

Alonaki · Published 2026-03-26 · Updated 2026-03-26 · CVE-2026-33531

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions InvenTree versions prior to 1.2.6 InvenTree versions 1.2.6 through 1.3.0

Description InvenTree is an Open Source Inventory Management System. A path traversal issue exists in the report template engine, allowing a staff-level user to read arbitrary files from the server filesystem through manipulated template tags. The affected functions are encode svg image(), asset(), and uploaded image() located in src/backend/InvenTree/report/templatetags/report.py. Exploitation requires staff access to upload or edit templates with malicious tags. If the InvenTree installation has high access privileges on the host system, this path traversal may enable access to files outside the InvenTree source directory.

Recommendations Update to InvenTree version 1.2.6 or later. Update to InvenTree version 1.3.0 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-33531

GHSA-RHC5-7C3R-C769

Affected Products

Inventree

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33531.json · Exploit
• https://github.com/inventree/InvenTree/security/advisories/GHSA-rhc5-7c3r-c769 · Vendor Advisory
• https://github.com/inventree/InvenTree/pull/11579 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33531 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33531 · Vendor Advisory
• https://twitter.com/CVEnew/status/2037280573388185682 · Twitter Post