CVE-2026-33531: InvenTree has Path Traversal In Report Templates
InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, a path traversal vulnerability in the report template engine allows a staff-level user to read arbitrary files from the server filesystem via crafted template tags. Affected functions: encodesvgimage(), asset(), and uploadedimage() in src/backend/InvenTree/report/templatetags/report.py. This requires staff access (to upload / edit templates with maliciously crafted tags). If the InvenTree installation is configured with high access privileges on the host system, this path traversal may allow file access outside of the InvenTree source directory. This issue is patched in version 1.2.6, and 1.3.0 (or above). Users should update to the patched versions. No known workarounds are available.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33531?
CVE-2026-33531 is classified as a critical severity vulnerability due to its potential to expose sensitive files on the server.
How do I fix CVE-2026-33531?
To fix CVE-2026-33531, upgrade InvenTree to version 1.2.6 or later, which addresses this path traversal vulnerability.
Who is affected by CVE-2026-33531?
CVE-2026-33531 affects all versions of InvenTree prior to 1.2.6, particularly impacting staff-level users.
What type of vulnerability is CVE-2026-33531?
CVE-2026-33531 is a path traversal vulnerability that allows unauthorized file access on the server.
What can an attacker do with CVE-2026-33531?
An attacker exploiting CVE-2026-33531 can read arbitrary files from the server filesystem, potentially leading to data breaches.