CVE-2026-33531: InvenTree Path Traversal Vulnerability

CVE-2026-33531 Overview

A path traversal vulnerability has been identified in InvenTree, an Open Source Inventory Management System. Prior to version 1.2.6, the report template engine allows a staff-level user to read arbitrary files from the server filesystem via crafted template tags. The vulnerability affects the encode_svg_image(), asset(), and uploaded_image() functions in the src/backend/InvenTree/report/templatetags/report.py file.

Critical Impact

Attackers with staff-level access can exploit maliciously crafted template tags to read sensitive files from the server filesystem, potentially exposing configuration files, credentials, and other confidential data beyond the InvenTree source directory.

Affected Products

• InvenTree versions prior to 1.2.6
• InvenTree versions prior to 1.3.0

Discovery Timeline

• 2026-03-26 - CVE CVE-2026-33531 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33531

Vulnerability Analysis

This path traversal vulnerability exists in InvenTree's report template engine, specifically within the template tag processing functionality. The vulnerable functions—encode_svg_image(), asset(), and uploaded_image()—fail to properly validate and sanitize user-supplied file paths before processing them. This allows an authenticated staff user to craft malicious template tags that traverse outside the intended directory structure using sequences like ../ to access files elsewhere on the server filesystem.

The exploitation requires staff-level access to upload or edit templates containing the maliciously crafted tags. When the server processes these templates, it follows the manipulated path references without adequate boundary checks, potentially exposing sensitive system files, configuration data, or application secrets.

Root Cause

The root cause of this vulnerability is insufficient input validation and path sanitization in the report template tag handlers. The affected functions (encode_svg_image(), asset(), and uploaded_image()) do not properly validate that requested file paths remain within the expected InvenTree directories. When user-controlled input containing directory traversal sequences is passed to these functions, the application follows the path without verifying it stays within safe boundaries, enabling access to arbitrary files on the filesystem.

Attack Vector

This vulnerability is exploitable over the network by authenticated users with staff-level privileges. An attacker would need to:

1. Authenticate to the InvenTree application with staff credentials
2. Create or modify a report template with malicious template tags containing path traversal sequences
3. Trigger the template processing to read arbitrary files from the server

The vulnerability becomes more severe when the InvenTree installation is configured with elevated access privileges on the host system, as this expands the range of accessible files. The attack requires no user interaction beyond the initial authentication and can be conducted remotely.

The malicious template tags would target the vulnerable functions by providing crafted paths that escape the intended directory. For example, a template tag referencing ../../../etc/passwd could potentially expose system user information. Technical details and the specific fix can be found in the GitHub Pull Request and GitHub Security Advisory.

Detection Methods for CVE-2026-33531

Indicators of Compromise

• Review report templates for suspicious path traversal sequences such as ../, ..\\, or encoded variants
• Monitor for unusual file access patterns from the InvenTree application process
• Check audit logs for staff users creating or modifying report templates with unexpected content
• Look for error logs indicating attempted access to files outside the InvenTree directory structure

Detection Strategies

• Implement file integrity monitoring on sensitive system files to detect unauthorized access attempts
• Configure web application firewall rules to detect and block path traversal patterns in template submissions
• Enable detailed logging for template creation and modification activities
• Monitor system calls from the InvenTree process for unexpected file read operations

Monitoring Recommendations

• Enable comprehensive audit logging for all template-related operations in InvenTree
• Set up alerts for file access attempts outside the InvenTree installation directory
• Monitor staff user activity for unusual template editing patterns
• Implement real-time log analysis to detect path traversal attack signatures

How to Mitigate CVE-2026-33531

Immediate Actions Required

• Update InvenTree to version 1.2.6 or 1.3.0 (or above) immediately
• Review existing report templates for any suspicious path traversal sequences
• Audit staff user accounts and remove unnecessary privileges
• Consider running InvenTree with minimal filesystem permissions until patching is complete

Patch Information

The vulnerability has been addressed in InvenTree version 1.2.6 and version 1.3.0 (or above). Users should update to one of these patched versions as soon as possible. The fix implements proper path validation and sanitization in the affected template tag functions to prevent directory traversal attacks.

For detailed patch information, refer to the GitHub Pull Request #11579 and the GitHub Security Advisory GHSA-rhc5-7c3r-c769.

Workarounds

• No official workarounds are available according to the vendor advisory
• As a temporary measure, restrict staff-level access to only essential, trusted personnel
• Implement additional monitoring on template creation and modification activities
• Consider running InvenTree with reduced filesystem permissions to limit the impact of potential exploitation

# Configuration example
# Update InvenTree to a patched version
# Using pip (adjust based on your installation method):
pip install --upgrade inventree>=1.2.6

# Verify the installed version
pip show inventree | grep Version