CVE-2026-33531

InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, a path traversal vulnerability in the report template engine allows a staff-level user to read arbitrary files from the server filesystem via crafted template tags. Affected functions: `encode_svg_image()`, `asset()`, and `uploaded_image()` in `src/backend/InvenTree/report/templatetags/report.py`. This requires staff access (to upload / edit templates with maliciously crafted tags). If the InvenTree installation is configured with high access privileges on the host system, this path traversal may allow file access outside of the InvenTree source directory. This issue is patched in version 1.2.6, and 1.3.0 (or above). Users should update to the patched versions. No known workarounds are available.

• CWE-89

• https://github.com/inventree/InvenTree/pull/11579Issue Tracking, Patch
• https://github.com/inventree/InvenTree/security/advisories/GHSA-rhc5-7c3r-c769Vendor Advisory

Published

Mar 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33526Squid is a caching proxy for the Web. Prior to version 7.5, …7.5
• CVE-2026-33527Parse Server is an open source backend that can be deployed …4.3
• CVE-2026-33528GoDoxy is a reverse proxy and container orchestrator for sel…6.5
• CVE-2026-33529Zoraxy is a general purpose HTTP reverse proxy and forwardin…8.8
• CVE-2026-3353The Comment SPAM Wiper plugin for WordPress is vulnerable to…4.4
• CVE-2026-33530InvenTree is an Open Source Inventory Management System. Pri…6.5
• CVE-2026-33532`yaml` is a YAML parser and serialiser for JavaScript. Parsi…4.3
• CVE-2026-33533Glances is an open-source system cross-platform monitoring t…6.5
• CVE-2026-33534EspoCRM is an open source customer relationship management a…4.3
• CVE-2026-33535ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-33536ImageMagick is free and open-source software used for editin…4.7
• CVE-2026-33537Lychee is a free, open-source photo-management tool. The pat…5