CVE-2026-33531

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-33531
InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, a path traversal vulnerability in the report template engine allows a staff-level user to read arbitrary files from the server filesystem via crafted template tags. Affected functions: `encode_svg_image()`, `asset()`, and `uploaded_image()` in `src/backend/InvenTree/report/templatetags/report.py`. This requires staff access (to upload / edit templates with maliciously crafted tags). If the InvenTree installation is configured with high access privileges on the host system, this path traversal may allow file access outside of the InvenTree source directory. This issue is patched in version 1.2.6, and 1.3.0 (or above). Users should update to the patched versions. No known workarounds are available.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/inventree/InvenTree/pull/11579 Issue Tracking Patch
https://github.com/inventree/InvenTree/security/advisories/GHSA-rhc5-7c3r-c769 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:inventree_project:inventree:*:*:*:*:*:*:*:*
History

01 Apr 2026, 18:50

Type Values Removed Values Added
CPE cpe:2.3:a:inventree_project:inventree:*:*:*:*:*:*:*:*
First Time Inventree Project
Inventree Project inventree
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
References () https://github.com/inventree/InvenTree/pull/11579 - () https://github.com/inventree/InvenTree/pull/11579 - Issue Tracking, Patch
References () https://github.com/inventree/InvenTree/security/advisories/GHSA-rhc5-7c3r-c769 - () https://github.com/inventree/InvenTree/security/advisories/GHSA-rhc5-7c3r-c769 - Vendor Advisory

30 Mar 2026, 13:26

Type Values Removed Values Added
Summary
  • (es) InvenTree es un Sistema de Gestión de Inventario de Código Abierto. Antes de la versión 1.2.6, una vulnerabilidad de salto de ruta en el motor de plantillas de informes permite a un usuario con nivel de personal leer archivos arbitrarios del sistema de archivos del servidor mediante etiquetas de plantilla manipuladas. Funciones afectadas: `encode_svg_image()`, `asset()` y `uploaded_image()` en `src/backend/InvenTree/report/templatetags/report.py`. Esto requiere acceso de personal (para cargar / editar plantillas con etiquetas creadas maliciosamente). Si la instalación de InvenTree está configurada con altos privilegios de acceso en el sistema anfitrión, este salto de ruta puede permitir el acceso a archivos fuera del directorio fuente de InvenTree. Este problema está parcheado en la versión 1.2.6, y 1.3.0 (o superior). Los usuarios deben actualizar a las versiones parcheadas. No se conocen soluciones alternativas disponibles.

26 Mar 2026, 20:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-26 20:16

Updated : 2026-04-01 18:50

NVD link : CVE-2026-33531

Mitre link : CVE-2026-33531

CVE.ORG link : CVE-2026-33531

JSON object : View

Products Affected

inventree_project

  • inventree
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')