Log in Start free

inventree

Products

ProductCVEsExploitedLatest
InvenTree16–Sep 21, 2026
inventree/inventree5–Sep 29, 2022

Exploited and recent CVEs

  • CVE-2026-61748 Medium 4.3 InvenTree: Report/Label print endpoints ignore per-model permissions 0.4%
  • CVE-2026-61746 Medium 5.3 InvenTree: Plugin-settings GET endpoints are readable without authentication 0.4%
  • CVE-2026-61744 Medium 6.5 InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view role 0.5%
  • CVE-2026-61747 Medium 4.3 InvenTree: Authenticated IDOR in the data-import API exposes other users' imported rows (`row_data`/`data`) and column mappings 0.3%
  • CVE-2026-61749 Medium 6.5 InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure 0.5%
  • CVE-2026-61745 Medium 4.3 InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipment 0.4%
  • CVE-2026-39362 Medium 5.3 InvenTree has SSRF via Remote Image Download — No IP/Hostname Validation on remote_image URLs 0.2%
  • CVE-2026-35479 Medium 6.6 InvenTree Plugin Installation - Insufficient Permissions 0.2%
  • CVE-2026-35476 High 7.2 InvenTree Affected by Privilege Escalation via API 0.1%
  • CVE-2026-35478 High 8.3 InvenTree has Arbitrary API Token Creation 0.3%
  • CVE-2026-35477 Medium 5.5 InvenTree has SSTI in PART_NAME_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escape 0.3%
  • CVE-2026-33531 Medium 4.9 InvenTree has Path Traversal In Report Templates 0.3%
  • CVE-2026-33530 High 7.7 InvenTree Vulnerable to ORM Filter Injection 0.2%
  • CVE-2026-27629 Medium 5.9 InvenTree Vulnerable to Server Side Template Injection (SSTI) 0.3%
  • CVE-2025-49000 Low 3.5 InvenTree has uncontrolled memory allocation via built-in label-sheet plugin 0.4%
  • CVE-2024-47610 High 7.3 Stored Cross-site Scripting Vulnerability in Markdown Editor 0.3%
  • CVE-2022-3355 High 8.2 Cross-site Scripting (XSS) - Stored in inventree/inventree 0.9%
  • CVE-2022-2134 High 7.1 Allocation of Resources Without Limits or Throttling in inventree/inventree 0.9%
  • CVE-2022-2113 High 8.4 Cross-site Scripting (XSS) - Stored in inventree/inventree 0.8%
  • CVE-2022-2112 Critical 9.0 Improper Neutralization of Formula Elements in a CSV File in inventree/inventree 1.3%
  • CVE-2022-2111 Critical 9.0 Unrestricted Upload of File with Dangerous Type in inventree/inventree 1.3%