{"id":"CVE-2026-61749","published":"2026-09-21T19:17:07.907","lastModified":"2026-09-21T19:17:07.907","description":"InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The HTML(string=html).write_pdf() path does not provide a restricted url_fetcher, and attach_to_model=True stores the original generated PDF before later processing, allowing fetched local files or internal HTTP response bodies to be recovered from embedded attachments. This enables full-read server-side request forgery, arbitrary local file disclosure including application credentials, and possible compromise of a superuser account. This issue is fixed in version 1.4.0.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-200","CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://github.com/inventree/InvenTree/commit/2b4f3037703bd499e420b6904153f2b66878d61b","tags":[]},{"url":"https://github.com/inventree/InvenTree/pull/12160","tags":[]},{"url":"https://github.com/inventree/InvenTree/releases/tag/1.4.0","tags":[]},{"url":"https://github.com/inventree/InvenTree/security/advisories/GHSA-568x-qh23-wh8g","tags":[]}],"exploitRefs":[{"url":"https://github.com/inventree/InvenTree/commit/2b4f3037703bd499e420b6904153f2b66878d61b","tags":[]},{"url":"https://github.com/inventree/InvenTree/pull/12160","tags":[]},{"url":"https://github.com/inventree/InvenTree/releases/tag/1.4.0","tags":[]},{"url":"https://github.com/inventree/InvenTree/security/advisories/GHSA-568x-qh23-wh8g","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows privileged users to retrieve attacker-selected resources through URL schemes or local file URIs during report rendering, leading to server-side request forgery and potential disclosure of sensitive files including credentials.","exploitability":"Exploitation requires a privileged user with access to template authoring. The difficulty is moderate due to the need for specific permissions but can be mitigated by restricting these roles.","blast_radius":"If exploited, this could lead to full-read server-side request forgery and disclosure of sensitive files, impacting system security and potentially compromising superuser accounts.","remediation":"Upgrade InvenTree to version 1.4.0 or later to apply the necessary fix.","tags":["ssrf","file-disclosure","privilege-escalation","web","security"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-22T06:19:51.586Z"}}