What’s Vulnerable › Products

InvenTree vulnerabilities

21 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.

Check whether your InvenTree version is affected

Latest InvenTree vulnerabilities

• CVE-2026-61749 — InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure (CVSS 6.5)
• CVE-2026-61748 — InvenTree: Report/Label print endpoints ignore per-model permissions (CVSS 4.3)
• CVE-2026-61747 — InvenTree: Authenticated IDOR in the data-import API exposes other users' imported rows (`row_data`/`data`) and column mappings (CVSS 4.3)
• CVE-2026-61746 — InvenTree: Plugin-settings GET endpoints are readable without authentication (CVSS 5.3)
• CVE-2026-61744 — InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view role (CVSS 6.5)
• CVE-2026-61745 — InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipment (CVSS 4.3)
• CVE-2026-39362 — InvenTree has SSRF via Remote Image Download — No IP/Hostname Validation on remote_image URLs (CVSS 7.1)
• CVE-2026-35479 — InvenTree Plugin Installation - Insufficient Permissions (CVSS 4.7)
• CVE-2026-35478 — InvenTree has Arbitrary API Token Creation (CVSS 8.1)
• CVE-2026-35477 — InvenTree has SSTI in PART_NAME_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escape (CVSS 9.9)
• CVE-2026-35476 — InvenTree Affected by Privilege Escalation via API (CVSS 4.3)
• CVE-2026-33531 — InvenTree has Path Traversal In Report Templates (CVSS 6.5)
• CVE-2026-33530 — InvenTree Vulnerable to ORM Filter Injection (CVSS 6.5)
• CVE-2026-27629 — InvenTree Vulnerable to Server Side Template Injection (SSTI) (CVSS 8.8)
• CVE-2025-49000 — InvenTree has uncontrolled memory allocation via built-in label-sheet plugin (CVSS 5.7)
• CVE-2024-47610 — Stored Cross-site Scripting Vulnerability in Markdown Editor (CVSS 5.4)
• CVE-2022-3355 — Cross-site Scripting (XSS) - Stored in inventree/inventree (CVSS 5.4)
• CVE-2022-2134 — Allocation of Resources Without Limits or Throttling in inventree/inventree (CVSS 6.5)
• CVE-2022-2113 — Cross-site Scripting (XSS) - Stored in inventree/inventree (CVSS 5.4)
• CVE-2022-2112 — Improper Neutralization of Formula Elements in a CSV File in inventree/inventree (CVSS 8.8)
• CVE-2022-2111 — Unrestricted Upload of File with Dangerous Type in inventree/inventree (CVSS 8.8)