CVE-2026-61749

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-61749
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61749.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-61749
Aliases
  • GHSA-568x-qh23-wh8g
Published
2026-09-21T18:31:54Z
Modified
2026-10-28T02:31:03Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure
Details

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The HTML(string=html).write_pdf() path does not provide a restricted url_fetcher, and attach_to_model=True stores the original generated PDF before later processing, allowing fetched local files or internal HTTP response bodies to be recovered from embedded attachments. This enables full-read server-side request forgery, arbitrary local file disclosure including application credentials, and possible compromise of a superuser account. This issue is fixed in version 1.4.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200",
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61749.json"
}
References

Affected packages

Git / github.com/inventree/inventree

Affected ranges

Type
GIT
Repo
https://github.com/inventree/inventree
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0a9a8b1c54d0811ede0a61ffe3b0427f82ee28e5
Fixed
2b4f3037703bd499e420b6904153f2b66878d61b
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.4.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "2b4f3037703bd499e420b6904153f2b66878d61b"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "1.4.0",
            "range": [
                {
                    "fixed": "0a9a8b1c54d0811ede0a61ffe3b0427f82ee28e5"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*
0.0.10
0.0.11
0.0.12
0.0.3
0.0.6
0.0.8
0.0.9
0.1.0
0.1.1
0.1.2
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.10.0
0.11.0
0.12.0
0.13.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.4.0
0.8.0
0.9.0
v0.*
v0.0.11
v0.0.5
v0.0.7
v0.1.3
v0.7.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61749.json"