CVE-2026-61749mediumCWE-200CWE-918

CVE-2026-61749: falha de média gravidade em InvenTree

InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar InvenTree

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.5%
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The HTML(string=html).write_pdf() path does not provide a restricted url_fetcher, and attach_to_model=True stores the original generated PDF before later processing, allowing fetched local files or internal HTTP response bodies to be recovered from embedded attachments. This enables full-read server-side request forgery, arbitrary local file disclosure including application credentials, and possible compromise of a superuser account. This issue is fixed in version 1.4.0.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
inventree · InvenTree
CVEs relacionadas — InvenTree

No mesmo produto, das mais perigosas para as menos.

CVE-2026-61744MEDIUMInvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view roleEPSS 0.5%CVE-2026-61745MEDIUMInvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipmentEPSS 0.4%CVE-2026-61748MEDIUMInvenTree: Report/Label print endpoints ignore per-model permissionsEPSS 0.4%CVE-2026-61746MEDIUMInvenTree: Plugin-settings GET endpoints are readable without authenticationEPSS 0.4%CVE-2025-49000LOWInvenTree has uncontrolled memory allocation via built-in label-sheet pluginEPSS 0.4%CVE-2026-61747MEDIUMInvenTree: Authenticated IDOR in the data-import API exposes other users' imported rows (`row_data`/`data`) and column mappingsEPSS 0.3%