CVE-2026-33531
InvenTree is an Open Source Inventory Management System.
Published Mar 26, 2026 · updated Oct 7, 2026 · inventree project inventree
InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, a path traversal vulnerability in the report template engine allows a staff-level user to read arbitrary files from the server filesystem via crafted template tags. Affected functions: , , and in . This requires staff access (to upload / edit templates with maliciously crafted tags). If the InvenTree installation is configured with high access privileges on the host system, this path traversal may allow file access outside of the InvenTree source directory. This issue is patched in version 1.2.6, and 1.3.0 (or above). Users should update to the patched versions. No known workarounds are available.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 26, 2026 · NIST NVD
Detected
InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, a path traversal vulnerability in the report template engine allows a staff-level user to read arbitrary files from the server filesystem via crafted template tags. Affected functions: , , and in . This requires staff access (to upload / edit templates with maliciously crafted tags). If the InvenTree installation is c
Oct 7, 2026 · NIST NVD
Updated
InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, a path traversal vulnerability in the report template engine allows a staff-level user to read arbitrary files from the server filesystem via crafted template tags. Affected functions: , , and in . This requires staff access (to upload / edit templates with maliciously crafted tags). If the InvenTree installation is c
Affected
- cpe inventree project/inventreeversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33531
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33531
InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, a path traversal vulnerability in the report template engine allows a staff-level user to read arbitrary files from the server filesystem via crafted template tags. Affected functions: `encode_svg_im
nvd.nist.gov