Server-Side Request Forgery and Local File Disclosure in InvenTree Inventory Management System
CVE-2026-61749

6.5MEDIUM

Key Information:

Vendor: Inventree
Status: Inventree
Vendor: CVE Published:; 21 September 2026

What is CVE-2026-61749?

InvenTree, an Open Source Inventory Management System, has a vulnerability that allows privileged staff users to exploit the system by causing WeasyPrint report rendering to access attacker-controlled resources. This occurs due to an insufficiently restricted URL fetcher in the HTML(string=html).write_pdf() functionality, enabling full-read server-side request forgery and arbitrary local file disclosure. This may include the exposure of sensitive application credentials and even pose a risk of compromising superuser accounts. The issue has been addressed in version 1.4.0 of the product.