Path Traversal Vulnerability in InvenTree Inventory Management System
CVE-2026-33531
Key Information:
Badges
What is CVE-2026-33531?
InvenTree, an open-source inventory management solution, contains a path traversal vulnerability in its report template engine prior to version 1.2.6. This allows users with staff-level access to leverage crafted template tags to read arbitrary files from the server’s filesystem, specifically affecting functions such as encode_svg_image(), asset(), and uploaded_image(). If the system hosting InvenTree has high-level access permissions, this vulnerability could enable unauthorized file access outside of the intended directories. To mitigate this risk, users are strongly encouraged to update to the patched versions, 1.2.6 or 1.3.0 (or later), as there are no known workarounds for this issue.
Affected Version(s)
InvenTree < 1.2.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.