Path Traversal Vulnerability in InvenTree Inventory Management System
CVE-2026-33531
Key Information:
Badges
What is CVE-2026-33531?
InvenTree, an open-source inventory management solution, contains a path traversal vulnerability in its report template engine prior to version 1.2.6. This allows users with staff-level access to leverage crafted template tags to read arbitrary files from the server’s filesystem, specifically affecting functions such as encode_svg_image(), asset(), and uploaded_image(). If the system hosting InvenTree has high-level access permissions, this vulnerability could enable unauthorized file access outside of the intended directories. To mitigate this risk, users are strongly encouraged to update to the patched versions, 1.2.6 or 1.3.0 (or later), as there are no known workarounds for this issue.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
InvenTree < 1.2.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved