Inventree Project vulnerabilities

Products

• Inventree 15

Newest

• inventree InvenTree has SSRF via Remote Image Download — No IP/Hostname Validation on remote_image URLs CVE-2026-39362 5.3 MediumApril 8, 2026
• inventree InvenTree Plugin Installation - Insufficient Permissions CVE-2026-35479 6.6 MediumApril 8, 2026
• inventree InvenTree Affected by Privilege Escalation via API CVE-2026-35476 7.2 HighApril 8, 2026
• inventree InvenTree has Arbitrary API Token Creation CVE-2026-35478 8.3 HighApril 8, 2026
• inventree InvenTree has SSTI in PART_NAME_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escape CVE-2026-35477 5.5 MediumApril 8, 2026
• inventree InvenTree has Path Traversal In Report Templates CVE-2026-33531 Public exploit 4.9 MediumMarch 26, 2026
• inventree InvenTree Vulnerable to ORM Filter Injection CVE-2026-33530 7.7 HighMarch 26, 2026
• inventree InvenTree Vulnerable to Server Side Template Injection (SSTI) CVE-2026-27629 5.9 MediumFebruary 25, 2026
• inventree InvenTree has uncontrolled memory allocation via built-in label-sheet plugin CVE-2025-49000 3.5 LowJune 3, 2025
• inventree Stored Cross-site Scripting Vulnerability in Markdown Editor CVE-2024-47610 7.3 HighOctober 7, 2024
• inventree inventree/inventree, inventree project inventree +1 more Cross-site Scripting (XSS) - Stored in inventree/inventree CVE-2022-3355 Fix available 8.2 HighSeptember 29, 2022
• inventree inventree/inventree, inventree project inventree +1 more Allocation of Resources Without Limits or Throttling in inventree/inventree CVE-2022-2134 7.1 HighJune 20, 2022
• inventree inventree/inventree, inventree project inventree +1 more Cross-site Scripting (XSS) - Stored in inventree/inventree CVE-2022-2113 8.4 HighJune 17, 2022
• inventree inventree/inventree, inventree project inventree +1 more Improper Neutralization of Formula Elements in a CSV File in inventree/inventree CVE-2022-2112 Fix available 9.0 CriticalJune 17, 2022
• inventree inventree/inventree, inventree project inventree +1 more Unrestricted Upload of File with Dangerous Type in inventree/inventree CVE-2022-2111 Fix available 9.0 CriticalJune 17, 2022