SSRF in Inventree
CVE-2026-39362
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, when INVENTREE_DOWNLOAD_FROM_URL is enabled (opt-in), authenticated users can supply remote_image URLs that are fetched server-side via requests.get() with only Django's URLValidator check. There is no validation against private IP ranges or internal hostnames. Redirects are followed (allow_redirects=True), enabling bypass of any URL-format checks. This vulnerability is fixed in 1.2.7 and 1.3.0.
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 0.002 (14.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N.
Affected products
- Inventree — versions < 1.2.7
- Inventree_project Inventree
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
Frequently asked questions
- What is CVE-2026-39362?
- CVE-2026-39362 is a high-severity vulnerability in Inventree, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.1/10. Published 2026-04-08.
- How severe is CVE-2026-39362?
- High severity. CVSS v3 base score is 7.1 out of 10.