Inventree vulnerabilities
We track 4 vulnerabilities in Inventree products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on April 8, 2026.
Latest Inventree vulnerabilities
- 7.1 High severity
InvenTree: Server-Side Request Forgery
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, when INVENTREE_DOWNLOAD_FROM_URL is enabled (opt-in), authenticated users can supply remote_image URLs that are fetched server-side via requests.get() with only Django's URLVali
- 8.1 High severity
InvenTree: Authorization Bypass Through User-Controlled Key
InvenTree is an Open Source Inventory Management System. From 0.16.0 to before 1.2.7, any authenticated InvenTree user can create a valid API token attributed to any other user in the system — including administrators and superusers — by supplying the target's
- 9.9 Critical severity
InvenTree: Improper Neutralization of Special Elements Used in a Template Engine
InvenTree is an Open Source Inventory Management System. From 1.2.3 to 1.2.6, the fix for CVE-2026-27629 upgraded the PART_NAME_FORMAT validator to use jinja2.sandbox.SandboxedEnvironment. However, the actual renderer in part/helpers.py was not updated and sti
- 8.8 High severity
InvenTree: Improper Neutralization of Special Elements Used in a Template Engine
InvenTree is an Open Source Inventory Management System. Prior to version 1.2.3, insecure server-side templates can be hijacked to expose secure information to the client. When generating custom batch codes, the InvenTree server makes use of a customizable jin