CVE-2026-61749

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The HTML(string=html).write_pdf() path does not provide a restricted url_fetcher, and attach_to_model=True stores the original generated PDF before later processing, allowing fetched local files or internal HTTP response bodies to be recovered from embedded attachments. This enables full-read server-side request forgery, arbitrary local file disclosure including application credentials, and possible compromise of a superuser account. This issue is fixed in version 1.4.0.

• CWE-200
• CWE-918

• https://github.com/inventree/InvenTree/commit/2b4f3037703bd499e420b6904153f2b66878d61b
• https://github.com/inventree/InvenTree/pull/12160
• https://github.com/inventree/InvenTree/releases/tag/1.4.0
• https://github.com/inventree/InvenTree/security/advisories/GHSA-568x-qh23-wh8g

Published

Sep 21, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61743Chartbrew is an open-source web application that can connect…6.3
• CVE-2026-61744InvenTree is an Open Source Inventory Management System. Pri…6.5
• CVE-2026-61745InvenTree is an Open Source Inventory Management System. Pri…4.3
• CVE-2026-61746InvenTree is an Open Source Inventory Management System. Pri…5.3
• CVE-2026-61747InvenTree is an Open Source Inventory Management System. Pri…4.3
• CVE-2026-61748InvenTree is an Open Source Inventory Management System. Pri…4.3
• CVE-2026-6175Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-61750NVIDIA Megatron Bridge contains a vulnerability where an att…7.8
• CVE-2026-61751NVIDIA Megatron Bridge contains a vulnerability where an att…7.8
• CVE-2026-61752NVIDIA Megatron Bridge contains a vulnerability where an att…7.8
• CVE-2026-61753NVIDIA Megatron Bridge contains a vulnerability where an att…7.8
• CVE-2026-61754NVIDIA Megatron Bridge contains a vulnerability where an att…7.8