Skip to contentInventree Project Inventree vulnerabilities
- inventreeInvenTree has SSRF via Remote Image Download — No IP/Hostname Validation on remote_image URLsCVE-2026-393625.3 Medium
- inventreeInvenTree Plugin Installation - Insufficient PermissionsCVE-2026-354796.6 Medium
- inventreeInvenTree Affected by Privilege Escalation via APICVE-2026-354767.2 High
- inventreeInvenTree has Arbitrary API Token CreationCVE-2026-354788.3 High
- inventreeInvenTree has SSTI in PART_NAME_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escapeCVE-2026-354775.5 Medium
- inventreeInvenTree has Path Traversal In Report TemplatesCVE-2026-33531Public exploit4.9 Medium
- inventreeInvenTree Vulnerable to ORM Filter InjectionCVE-2026-335307.7 High
- inventreeInvenTree Vulnerable to Server Side Template Injection (SSTI)CVE-2026-276295.9 Medium
- inventreeInvenTree has uncontrolled memory allocation via built-in label-sheet pluginCVE-2025-490003.5 Low
- inventreeStored Cross-site Scripting Vulnerability in Markdown EditorCVE-2024-476107.3 High
- inventree inventree/inventree, inventree project inventree +1 moreCross-site Scripting (XSS) - Stored in inventree/inventreeCVE-2022-3355Fix available8.2 High
- inventree inventree/inventree, inventree project inventree +1 moreAllocation of Resources Without Limits or Throttling in inventree/inventreeCVE-2022-21347.1 High
- inventree inventree/inventree, inventree project inventree +1 moreCross-site Scripting (XSS) - Stored in inventree/inventreeCVE-2022-21138.4 High
- inventree inventree/inventree, inventree project inventree +1 moreImproper Neutralization of Formula Elements in a CSV File in inventree/inventreeCVE-2022-2112Fix available9.0 Critical
- inventree inventree/inventree, inventree project inventree +1 moreUnrestricted Upload of File with Dangerous Type in inventree/inventreeCVE-2022-2111Fix available9.0 Critical