CVE-2026-61749: InvenTree SSRF Vulnerability

CVE-2026-61749 Overview

InvenTree, an open source inventory management system, contains a server-side request forgery (SSRF) and arbitrary file disclosure vulnerability in its PDF report rendering pipeline. Privileged staff users who can author report or label templates can force WeasyPrint to fetch attacker-selected resources over HTTP, HTTPS, or the local file:// URI scheme. The HTML(string=html).write_pdf() code path does not supply a restricted url_fetcher, and the attach_to_model=True option preserves the original generated PDF, allowing fetched content to be recovered from embedded attachments. The flaw is tracked as [CWE-200] and is fixed in InvenTree 1.4.0.

Critical Impact
Authenticated staff users can read arbitrary local files including application credentials, perform full-read SSRF against internal services, and potentially compromise a superuser account.

Affected Products

InvenTree versions prior to 1.4.0
Report template rendering component (WeasyPrint integration)
Label template rendering component (label_sheet.py)

Discovery Timeline

2026-09-21 - CVE-2026-61749 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-61749

Vulnerability Analysis

InvenTree renders PDF reports and labels using the WeasyPrint library. The renderer accepts HTML template output and resolves any embedded URLs during PDF generation. Because the HTML(string=html).write_pdf() invocation did not pass a restricted url_fetcher, WeasyPrint used its default fetcher, which honors http://, https://, and file:// schemes without restriction.

A staff user with template authoring rights can embed references such as <img src="file:///etc/passwd"> or <link href="http://169.254.169.254/latest/meta-data/"> in a template. When the report is generated with attach_to_model=True, the original PDF is stored against the model before post-processing. The attacker can then download the stored PDF and extract the fetched file contents or HTTP response bodies from the embedded attachments, achieving full-read SSRF and local file disclosure.

Root Cause

The root cause is missing URL scheme and destination filtering in the WeasyPrint invocation. Without a custom url_fetcher, external and local resources are resolved by default. Combined with attachment persistence, this converts a rendering feature into a reliable exfiltration channel.

Attack Vector

Exploitation requires an authenticated staff account with permission to create or modify report or label templates. The attacker crafts a template referencing internal HTTP endpoints or local file URIs, triggers report generation with model attachment enabled, and retrieves the resulting PDF to read the fetched data. This can expose configuration files, environment secrets, cloud metadata service responses, and stored credentials that permit takeover of a superuser account.

python

# Patch excerpt: introduces an opt-in setting to control remote URL fetching
# Source: src/backend/InvenTree/common/setting/system.py
'REPORT_FETCH_URLS': {
    'name': _('Report URL Fetching'),
    'description': _('Allow fetching of remote URLs when generating reports'),
    'default': False,
    'validator': bool,
},

Source: GitHub commit 2b4f303

python

# Patch excerpt: label rendering imports a restricted URL fetcher
# Source: src/backend/InvenTree/plugin/builtin/labels/label_sheet.py
from report.fetcher import InvenTreeURLFetcher
from report.models import LabelTemplate

Source: GitHub commit 2b4f303

Detection Methods for CVE-2026-61749

Indicators of Compromise

Report or label templates containing file://, http://, or https:// references to non-approved hosts or local paths.
Outbound HTTP requests originating from the InvenTree application server to internal IP ranges, 169.254.169.254, or localhost during report generation.
Unusually large PDF attachments stored against models shortly after template edits by staff accounts.
Access log entries showing template modifications followed by immediate report downloads.

Detection Strategies

Audit the InvenTree template store for embedded URLs or URIs that reference sensitive schemes and internal endpoints.
Correlate template authoring events with subsequent report generation and download activity by the same staff account.
Inspect generated PDF attachments for content that does not match the intended template output, such as raw file text or HTTP response bodies.

Monitoring Recommendations

Enable network egress logging on the InvenTree host and alert on connections to metadata services and RFC1918 addresses.
Monitor for changes to REPORT_FETCH_URLS and related report configuration settings after upgrading.
Track privileged staff account activity, particularly template creation and modification, in a centralized log platform.

How to Mitigate CVE-2026-61749

Immediate Actions Required

Upgrade InvenTree to version 1.4.0 or later, which introduces InvenTreeURLFetcher and the REPORT_FETCH_URLS opt-in control.
Review all existing report and label templates for suspicious external or local URI references and remove any unauthorized entries.
Rotate application secrets, database credentials, and any tokens accessible from the InvenTree host if exploitation is suspected.
Audit staff and superuser accounts for unexpected privilege changes or session activity.

Patch Information

The fix is delivered in InvenTree Release 1.4.0 via Pull Request #12160. Full technical details are described in GitHub Security Advisory GHSA-568x-qh23-wh8g. The patch introduces a restricted InvenTreeURLFetcher for WeasyPrint and gates remote URL fetching behind the new REPORT_FETCH_URLS setting, which defaults to False.

Workarounds

Restrict the set of accounts that hold staff privileges to author report or label templates.
Deploy the InvenTree application inside a network segment that blocks egress to cloud metadata services and internal management interfaces.
Disable or avoid using attach_to_model=True for report generation until the upgrade is applied.

bash

# After upgrading to 1.4.0, keep remote URL fetching disabled unless required
# Setting name: REPORT_FETCH_URLS (default: False)
# Configure via the InvenTree admin settings UI or API
curl -X PATCH "https://inventree.example.com/api/settings/global/REPORT_FETCH_URLS/" \
  -H "Authorization: Token <admin-token>" \
  -H "Content-Type: application/json" \
  -d '{"value": "False"}'